Hi, Le mar. 6 janv. 2026, 03:13, 0xBat via ffmpeg-devel <[email protected]> a écrit :
> In libavcodec/vvc/ctu.c, the functions set_tb_size and set_cb_pos lack > proper boundary checks before performing memset operations. This patch adds > validation against PPS dimensions to prevent heap overflows. > > Signed-off-by: 0xBat <[email protected]> > --- > libavcodec/vvc/ctu.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c > index 18cbe0fe0f..ce8a7ab90e 100644 > --- a/libavcodec/vvc/ctu.c > +++ b/libavcodec/vvc/ctu.c > @@ -52,6 +52,9 @@ static void set_tb_size(const VVCFrameContext *fc, const > TransformBlock *tb) > > for (int y = y_tb; y < end; y++) { > const int off = y * fc->ps.pps->min_tu_width + x_tb; > + int max_off = fc->ps.pps->min_tu_width * > fc->ps.pps->min_tu_height; > + if (off + width > max_off) > + return; > memset(fc->tab.tb_width [is_chroma] + off, tb->tb_width, width); > memset(fc->tab.tb_height[is_chroma] + off, tb->tb_height, width); > } > @@ -1185,6 +1188,8 @@ static void set_cb_pos(const VVCFrameContext *fc, > const CodingUnit *cu) > fc->tab.cb_pos_x[ch_type][x + i] = cu->x0; > fc->tab.cb_pos_y[ch_type][x + i] = cu->y0; > } > + if (x + width > fc->ps.pps->min_tu_width * > fc->ps.pps->min_tu_height) > + return; > memset(&fc->tab.cb_width[ch_type][x], cu->cb_width, width); > memset(&fc->tab.cb_height[ch_type][x], cu->cb_height, width); > memset(&fc->tab.cqt_depth[ch_type][x], cu->cqt_depth, width); > So lines that are processed are ok if overflowing. It sounds like width should be clipped if that's an expected behaviour, or width is incorrect to being with? This is a question probably more for the maintainers/contributors. Regards, Christophe > _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
