PR #20139 opened by Kacper Michajłow (kasper93)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20139
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20139.patch
current->num_tile_columns is not updated in the loop, so the existing
check was not working. Check current index instead and break. This also
simplifies duplicated log.
Fixes: OSS-Fuzz/435225531
From ebf4e9dd03f62e14ca1af17f6ff3ac6d77ddc96a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kaspe...@gmail.com>
Date: Wed, 6 Aug 2025 18:26:42 +0200
Subject: [PATCH] avcodec/cbs_h266_syntax_template: fix out of bounds access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
current->num_tile_columns is not updated in the loop, so the existing
check was not working. Check current index instead and break. This also
simplifies duplicated log.
Fixes: OSS-Fuzz/435225531
Signed-off-by: Kacper Michajłow <kaspe...@gmail.com>
---
libavcodec/cbs_h266_syntax_template.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/libavcodec/cbs_h266_syntax_template.c
b/libavcodec/cbs_h266_syntax_template.c
index e2cc461bff..de80daaf0b 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -1897,12 +1897,8 @@ static int FUNC(pps) (CodedBitstreamContext *ctx,
RWContext *rw,
}
unified_size = current->pps_tile_column_width_minus1[i - 1] + 1;
while (remaining_size > 0) {
- if (current->num_tile_columns > VVC_MAX_TILE_COLUMNS) {
- av_log(ctx->log_ctx, AV_LOG_ERROR,
- "NumTileColumns(%d) > than VVC_MAX_TILE_COLUMNS(%d)\n",
- current->num_tile_columns, VVC_MAX_TILE_COLUMNS);
- return AVERROR_INVALIDDATA;
- }
+ if (i >= VVC_MAX_TILE_COLUMNS)
+ break;
unified_size = FFMIN(remaining_size, unified_size);
current->col_width_val[i] = unified_size;
remaining_size -= unified_size;
--
2.49.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
