[FFmpeg-cvslog] avcodec/cbs_h266: more restrictive check on pps_tile_idx_delta_val

2023-12-29 Thread Nuo Mi 
ffmpeg | branch: release/6.1 | Nuo Mi  | Sun Oct 22 
11:04:35 2023 +0800| [0ecd15b83931c8aa4a71d73ac4edda734b2bd23a] | committer: 
Michael Niedermayer

avcodec/cbs_h266: more restrictive check on pps_tile_idx_delta_val

Fixes: out of array access
Fixes: 
62603/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5837632490569728

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit ce0c178a408d43e71085c28a47d50dc939b60196)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0ecd15b83931c8aa4a71d73ac4edda734b2bd23a
---

 libavcodec/cbs_h266_syntax_template.c | 7 +--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/libavcodec/cbs_h266_syntax_template.c 
b/libavcodec/cbs_h266_syntax_template.c
index 5654f22878..5a34200a18 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -2043,9 +2043,12 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, 
RWContext *rw,
 }
 if (i < current->pps_num_slices_in_pic_minus1) {
 if (current->pps_tile_idx_delta_present_flag) {
+// Two conditions must be met:
+// 1. −NumTilesInPic + 1 <= pps_tile_idx_delta_val[i] 
<= NumTilesInPic − 1
+// 2. 0 <= tile_idx + pps_tile_idx_delta_val[i] <= 
NumTilesInPic − 1
+// Combining these conditions yields: -tile_idx <= 
pps_tile_idx_delta_val[i] <= NumTilesInPic - 1 - tile_idx
 ses(pps_tile_idx_delta_val[i],
--current->num_tiles_in_pic + 1,
-current->num_tiles_in_pic - 1, 1, i);
+-tile_idx, current->num_tiles_in_pic - 1 - 
tile_idx, 1, i);
 if (current->pps_tile_idx_delta_val[i] == 0) {
 av_log(ctx->log_ctx, AV_LOG_ERROR,
"pps_tile_idx_delta_val[i] shall not be 
equal to 0.\n");

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/cbs_h266: more restrictive check on pps_tile_idx_delta_val

2023-12-14 Thread Nuo Mi 
ffmpeg | branch: master | Nuo Mi  | Sun Oct 22 11:04:35 
2023 +0800| [ce0c178a408d43e71085c28a47d50dc939b60196] | committer: Michael 
Niedermayer

avcodec/cbs_h266: more restrictive check on pps_tile_idx_delta_val

Fixes: out of array access
Fixes: 
62603/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5837632490569728

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ce0c178a408d43e71085c28a47d50dc939b60196
---

 libavcodec/cbs_h266_syntax_template.c | 7 +--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/libavcodec/cbs_h266_syntax_template.c 
b/libavcodec/cbs_h266_syntax_template.c
index dd884ad449..549d021211 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -2043,9 +2043,12 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, 
RWContext *rw,
 }
 if (i < current->pps_num_slices_in_pic_minus1) {
 if (current->pps_tile_idx_delta_present_flag) {
+// Two conditions must be met:
+// 1. −NumTilesInPic + 1 <= pps_tile_idx_delta_val[i] 
<= NumTilesInPic − 1
+// 2. 0 <= tile_idx + pps_tile_idx_delta_val[i] <= 
NumTilesInPic − 1
+// Combining these conditions yields: -tile_idx <= 
pps_tile_idx_delta_val[i] <= NumTilesInPic - 1 - tile_idx
 ses(pps_tile_idx_delta_val[i],
--current->num_tiles_in_pic + 1,
-current->num_tiles_in_pic - 1, 1, i);
+-tile_idx, current->num_tiles_in_pic - 1 - 
tile_idx, 1, i);
 if (current->pps_tile_idx_delta_val[i] == 0) {
 av_log(ctx->log_ctx, AV_LOG_ERROR,
"pps_tile_idx_delta_val[i] shall not be 
equal to 0.\n");

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".