aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2021-09-19 22:35:36 +0200
committerMichael Niedermayer <michael@niedermayer.cc>2021-10-06 14:41:42 +0200
commit10f73661a23d6a410e5a256accaec31ebf476530 (patch)
tree9ea503c35cc6f95cd0c938a656d064aeaa760106
parentd9bfc347b3ff47040ffdff81ff8612cd21977535 (diff)
downloadffmpeg-10f73661a23d6a410e5a256accaec31ebf476530.tar.gz
avcodec/cbs_h265_syntax_template: Limit sps_num_palette_predictor_initializer_minus1 to 127
Fixes: index 128 out of bounds for type 'uint16_t [128]' Fixes: 38651/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-6296416058736640 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: James Almer <jamrial@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 85413a5ae6948a1d6e4e947a4fca984b8c686016) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavcodec/cbs_h265_syntax_template.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/cbs_h265_syntax_template.c b/libavcodec/cbs_h265_syntax_template.c
index 48fae82d04..8c7ca53c29 100644
--- a/libavcodec/cbs_h265_syntax_template.c
+++ b/libavcodec/cbs_h265_syntax_template.c
@@ -728,7 +728,7 @@ static int FUNC(sps_scc_extension)(CodedBitstreamContext *ctx, RWContext *rw,
flag(sps_palette_predictor_initializer_present_flag);
if (current->sps_palette_predictor_initializer_present_flag) {
- ue(sps_num_palette_predictor_initializer_minus1, 0, 128);
+ ue(sps_num_palette_predictor_initializer_minus1, 0, 127);
for (comp = 0; comp < (current->chroma_format_idc ? 3 : 1); comp++) {
int bit_depth = comp == 0 ? current->bit_depth_luma_minus8 + 8
: current->bit_depth_chroma_minus8 + 8;