videolan
/
ffmpeg
mirror of https://git.videolan.org/git/ffmpeg.git
1
Fork 0
Code Releases Activity

avcodec/cbs_h266: more restrictive check on pps_tile_idx_delta_val 

Fixes: out of array access
Fixes: 62603/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5837632490569728

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Nuo Mi 2023-10-22 11:04:35 +08:00 committed by Michael Niedermayer
parent a1384b4e86
commit ce0c178a40
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/cbs_h266_syntax_template.c
View File

@ -2043,9 +2043,12 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
}
if (i < current->pps_num_slices_in_pic_minus1) {
if (current->pps_tile_idx_delta_present_flag) {
// Two conditions must be met:
// 1. −NumTilesInPic + 1 <= pps_tile_idx_delta_val[i] <= NumTilesInPic − 1
// 2. 0 <= tile_idx + pps_tile_idx_delta_val[i] <= NumTilesInPic − 1
// Combining these conditions yields: -tile_idx <= pps_tile_idx_delta_val[i] <= NumTilesInPic - 1 - tile_idx
ses(pps_tile_idx_delta_val[i],
-current->num_tiles_in_pic + 1,
current->num_tiles_in_pic - 1, 1, i);
-tile_idx, current->num_tiles_in_pic - 1 - tile_idx, 1, i);
if (current->pps_tile_idx_delta_val[i] == 0) {
av_log(ctx->log_ctx, AV_LOG_ERROR,
"pps_tile_idx_delta_val[i] shall not be equal to 0.\n");