PR #23248 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23248 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23248.patch
The PPS slice-height ues() bound check uses `remaining_height_in_ctbs_y - 1` without first ensuring remaining_height_in_ctbs_y >= 1. When the field reaches 0, the bound underflows to UINT32_MAX and any attacker value is accepted. Add a precondition check `remaining_height_in_ctbs_y < 1` that returns AVERROR_INVALIDDATA before the ues() call. The malformed PPS is rejected with no downstream side effects. Found-by: Claude (Anthropic). Human-verified and reported by Omkhar Arasaratnam <[email protected]>. Signed-off-by: Omkhar Arasaratnam <[email protected]> No testcase, i attempted to create one but Claude created a fake testcase Signed-off-by: Michael Niedermayer <[email protected]> >From 6cf21f913e8d17bd86549074c80c0493689aae04 Mon Sep 17 00:00:00 2001 From: Omkhar Arasaratnam <[email protected]> Date: Thu, 21 May 2026 00:00:00 +0000 Subject: [PATCH] avcodec/cbs_h266_syntax_template: reject PPS with remaining_height_in_ctbs_y < 1 before slice_height ues() The PPS slice-height ues() bound check uses `remaining_height_in_ctbs_y - 1` without first ensuring remaining_height_in_ctbs_y >= 1. When the field reaches 0, the bound underflows to UINT32_MAX and any attacker value is accepted. Add a precondition check `remaining_height_in_ctbs_y < 1` that returns AVERROR_INVALIDDATA before the ues() call. The malformed PPS is rejected with no downstream side effects. Found-by: Claude (Anthropic). Human-verified and reported by Omkhar Arasaratnam <[email protected]>. Signed-off-by: Omkhar Arasaratnam <[email protected]> No testcase, i attempted to create one but Claude created a fake testcase Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/cbs_h266_syntax_template.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c index b5aa235334..6a69b99b2c 100644 --- a/libavcodec/cbs_h266_syntax_template.c +++ b/libavcodec/cbs_h266_syntax_template.c @@ -2021,6 +2021,8 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw, for (j = 0; j < current->pps_num_exp_slices_in_tile[i]; j++) { + if (remaining_height_in_ctbs_y < 1) + return AVERROR_INVALIDDATA; ues(pps_exp_slice_height_in_ctus_minus1[i][j], 0, remaining_height_in_ctbs_y - 1, 2, i, j); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
