On Sun, May 18, 2025 at 2:51 PM Frank Plowman <p...@frankplowman.com> wrote:
> On 18/05/2025 02:42, Nuo Mi wrote: > > Hi Frank, > > 👍,your fuzzing infrastructure caught this issue as well. > > How about this: > > > https://patchwork.ffmpeg.org/project/ffmpeg/patch/20250517055150.807683-1-nuomi2...@gmail.com/ > > Sorry, I missed this. Your patch looks good to me: probably preferable > in that it also validates the predicted size by the looks of it > (although I don't have a stream which exercises this aspect). > Hi Frank, Not needed — we get predictor_size from lc->ep->pp[c].size. lc->ep->pp[i].size is protected by max_predictor, which is smaller than VVC_MAX_NUM_PALETTE_PREDICTOR_SIZE. > > > > > On Sun, May 18, 2025 at 5:05 AM Frank Plowman <p...@frankplowman.com> > wrote: > > > >> "The value of CurrentPaletteSize[ startComp ] shall be in the range of 0 > >> to maxNumPaletteEntries, inclusive." > >> > >> Signed-off-by: Frank Plowman <p...@frankplowman.com> > >> --- > >> libavcodec/vvc/ctu.c | 14 +++++++++++--- > >> 1 file changed, 11 insertions(+), 3 deletions(-) > >> > >> diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c > >> index 62c9d4f5c0..70800ba5fa 100644 > >> --- a/libavcodec/vvc/ctu.c > >> +++ b/libavcodec/vvc/ctu.c > >> @@ -20,6 +20,7 @@ > >> * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA > >> 02110-1301 USA > >> */ > >> > >> +#include "libavutil/error.h" > >> #include "libavutil/refstruct.h" > >> > >> #include "cabac.h" > >> @@ -1873,7 +1874,7 @@ static void palette_predicted(VVCLocalContext *lc, > >> const bool local_dual_tree, i > >> cu->plt[c].size = nb_predicted; > >> } > >> > >> -static void palette_signaled(VVCLocalContext *lc, const bool > >> local_dual_tree, > >> +static int palette_signaled(VVCLocalContext *lc, const bool > >> local_dual_tree, > >> const int start, const int end, const int max_entries) > >> { > >> const VVCSPS *sps = lc->fc->ps.sps; > >> @@ -1883,6 +1884,9 @@ static void palette_signaled(VVCLocalContext *lc, > >> const bool local_dual_tree, > >> const int size = nb_predicted + nb_signaled; > >> const bool dual_tree_luma = local_dual_tree && cu->tree_type == > >> DUAL_TREE_LUMA; > >> > >> + if (size > max_entries) > >> + return AVERROR_INVALIDDATA; > >> + > >> for (int c = start; c < end; c++) { > >> Palette *plt = cu->plt + c; > >> for (int i = nb_predicted; i < size; i++) { > >> @@ -1894,6 +1898,8 @@ static void palette_signaled(VVCLocalContext *lc, > >> const bool local_dual_tree, > >> } > >> plt->size = size; > >> } > >> + > >> + return 0; > >> } > >> > >> static void palette_update_predictor(VVCLocalContext *lc, const bool > >> local_dual_tree, int start, int end, > >> @@ -2070,7 +2076,7 @@ static int hls_palette_coding(VVCLocalContext *lc, > >> const VVCTreeType tree_type) > >> int max_index = 0; > >> int prev_run_pos = 0; > >> > >> - int predictor_size, start, end; > >> + int predictor_size, start, end, ret; > >> bool reused[VVC_MAX_NUM_PALETTE_PREDICTOR_SIZE]; > >> uint8_t run_type[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE]; > >> uint8_t index[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE]; > >> @@ -2083,7 +2089,9 @@ static int hls_palette_coding(VVCLocalContext *lc, > >> const VVCTreeType tree_type) > >> predictor_size = pp[start].size; > >> memset(reused, 0, sizeof(reused[0]) * predictor_size); > >> palette_predicted(lc, local_dual_tree, start, end, reused, > >> predictor_size, max_entries); > >> - palette_signaled(lc, local_dual_tree, start, end, max_entries); > >> + ret = palette_signaled(lc, local_dual_tree, start, end, > max_entries); > >> + if (ret < 0) > >> + return ret; > >> palette_update_predictor(lc, local_dual_tree, start, end, reused, > >> predictor_size); > >> > >> if (cu->plt[start].size > 0) > >> -- > >> 2.47.0 > >> > >> > > _______________________________________________ > > ffmpeg-devel mailing list > > ffmpeg-devel@ffmpeg.org > > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > > > To unsubscribe, visit link above, or email > > ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe". > > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe". > _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
