This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new fa4daf630e avcodec/rv60dec: validate angular prediction buffer bounds
fa4daf630e is described below
commit fa4daf630eb52235b1b3d0e9b1cc08392b87e9a8
Author: lusoris <[email protected]>
AuthorDate: Thu Oct 15 22:06:35 2026 +0200
Commit: Peter Ross <[email protected]>
CommitDate: Tue Oct 27 05:07:26 2026 +0000
avcodec/rv60dec: validate angular prediction buffer bounds
GCC 14.4.0 and 16.2.1 report -Wstringop-overflow in angular prediction.
Unchecked block sizes and derived filter lengths could exceed the local
reference buffer. Require a power-of-two size from 4 to 64 and bound the
weak and bilinear filter lengths before writing. Prediction is unchanged
for sizes and lengths within those bounds.
Signed-off-by: lusoris <[email protected]>
---
libavcodec/rv60dec.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/libavcodec/rv60dec.c b/libavcodec/rv60dec.c
index 2a7c5c1147..555e1b8081 100644
--- a/libavcodec/rv60dec.c
+++ b/libavcodec/rv60dec.c
@@ -662,6 +662,9 @@ static int pred_angle(const IntraPredContext * p, uint8_t *
dst, int stride, int
{
uint8_t filtered1[96], filtered2[96];
+ if (size < 4 || size > 64 || (size & (size - 1)))
+ return AVERROR_INVALIDDATA;
+
if (!imode) {
pred_plane(p, dst, stride, size);
} else if (imode == 1) {
@@ -670,8 +673,13 @@ static int pred_angle(const IntraPredContext * p, uint8_t
* dst, int stride, int
int ang_weight = rv60_ipred_angle[10 - imode];
int add_size = (size * ang_weight + 31) >> 5;
if (size <= 16) {
- filter_weak(filtered1 + 32, &p->l[1], size + add_size);
+ const int filtered_size = size + add_size;
+ if (filtered_size < 1 || filtered_size > 64)
+ return AVERROR_INVALIDDATA;
+ filter_weak(filtered1 + 32, &p->l[1], filtered_size);
} else {
+ if (add_size < 0 || add_size > 32)
+ return AVERROR_INVALIDDATA;
filter_bilin32(filtered1 + 32, p->l[1], p->l[33], 32);
filter_bilin32(filtered1 + 64, p->l[32], p->l[64], add_size);
}
@@ -746,9 +754,14 @@ static int pred_angle(const IntraPredContext * p, uint8_t
* dst, int stride, int
} else if (imode <= 34) {
int ang_weight = rv60_ipred_angle[imode - 26];
int add_size = (size * ang_weight + 31) >> 5;
- if (size <= 16)
- filter_weak(&filtered1[32], &p->t[1], size + add_size);
- else {
+ if (size <= 16) {
+ const int filtered_size = size + add_size;
+ if (filtered_size < 1 || filtered_size > 64)
+ return AVERROR_INVALIDDATA;
+ filter_weak(&filtered1[32], &p->t[1], filtered_size);
+ } else {
+ if (add_size < 0 || add_size > 32)
+ return AVERROR_INVALIDDATA;
filter_bilin32(filtered1 + 32, p->t[1], p->t[33], 32);
filter_bilin32(filtered1 + 64, p->t[32], p->t[64], add_size);
}
--
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
