har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

lavc/vvc: Fix slice_idx out-of-bounds memset

Browse Source 
If the number of CTUs reduces between one picture and the next, the
slice_idx table is reduced in size in the frame_context_for_each_tl call
on vvcdec.c:321.  When initialising the slice_idx table on vvcdec.c:325,
the old code uses fc->tab.sz.ctu_count when calculating the table size.
fc->tab.sz.ctu_count holds the old ctu count at this point however, not
being updated to hold the new ctu count until vvcdec.c:342.  This causes
an out-of-bounds write.

Patch fixes the problem by using pps->ctb_count, which was just used
when allocating the table, in place of fc->tab.sz.ctu_count when
initialising the table.

Signed-off-by: Frank Plowman <post@frankplowman.com>
This commit is contained in:
Frank Plowman 2024-02-05 18:00:05 +00:00 committed by Nuo Mi
parent aa1a194a7e
commit a42f884cd2
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/vvc/vvcdec.c
View File

@ -322,7 +322,7 @@ static int pic_arrays_init(VVCContext *s, VVCFrameContext *fc)
if (ret < 0) if (ret < 0)
return ret; return ret;
memset(fc->tab.slice_idx, -1, sizeof(*fc->tab.slice_idx) * fc->tab.sz.ctu_count); memset(fc->tab.slice_idx, -1, sizeof(*fc->tab.slice_idx) * ctu_count);
if (fc->tab.sz.ctu_count != ctu_count) { if (fc->tab.sz.ctu_count != ctu_count) {
ff_refstruct_pool_uninit(&fc->rpl_tab_pool); ff_refstruct_pool_uninit(&fc->rpl_tab_pool);