FFmpeg/libavcodec
Frank Plowman a42f884cd2 lavc/vvc: Fix slice_idx out-of-bounds memset
If the number of CTUs reduces between one picture and the next, the
slice_idx table is reduced in size in the frame_context_for_each_tl call
on vvcdec.c:321.  When initialising the slice_idx table on vvcdec.c:325,
the old code uses fc->tab.sz.ctu_count when calculating the table size.
fc->tab.sz.ctu_count holds the old ctu count at this point however, not
being updated to hold the new ctu count until vvcdec.c:342.  This causes
an out-of-bounds write.

Patch fixes the problem by using pps->ctb_count, which was just used
when allocating the table, in place of fc->tab.sz.ctu_count when
initialising the table.

Signed-off-by: Frank Plowman <post@frankplowman.com>
2024-02-06 19:45:43 +08:00
..
2024-02-02 15:41:54 +01:00
2023-12-11 18:42:07 +02:00
2023-11-26 17:49:09 +01:00
2023-11-26 17:49:09 +01:00
2024-01-25 11:07:28 -05:00
2023-12-11 18:17:43 +02:00
2023-12-11 18:17:43 +02:00
2023-12-29 00:45:20 +01:00
2023-12-22 09:28:04 -03:00
2023-12-22 09:28:04 -03:00
2023-12-08 17:20:48 +02:00
2023-12-08 17:20:48 +02:00
2024-02-03 00:26:17 +01:00