diff options
| author | Nuo Mi <nuomi2021@gmail.com> | 2023-10-22 11:04:35 +0800 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2023-12-14 23:53:10 +0100 |
| commit | ce0c178a408d43e71085c28a47d50dc939b60196 (patch) | |
| tree | dcdbf9f0d66a3ee97caf1f9c7dff6a9527a4da72 | |
| parent | a1384b4e869483cf69230f02ca31c892729bca08 (diff) | |
| download | ffmpeg-ce0c178a408d43e71085c28a47d50dc939b60196.tar.gz | |
avcodec/cbs_h266: more restrictive check on pps_tile_idx_delta_val
Fixes: out of array access
Fixes: 62603/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5837632490569728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/cbs_h266_syntax_template.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c index dd884ad449..549d021211 100644 --- a/libavcodec/cbs_h266_syntax_template.c +++ b/libavcodec/cbs_h266_syntax_template.c @@ -2043,9 +2043,12 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw, } if (i < current->pps_num_slices_in_pic_minus1) { if (current->pps_tile_idx_delta_present_flag) { + // Two conditions must be met: + // 1. −NumTilesInPic + 1 <= pps_tile_idx_delta_val[i] <= NumTilesInPic − 1 + // 2. 0 <= tile_idx + pps_tile_idx_delta_val[i] <= NumTilesInPic − 1 + // Combining these conditions yields: -tile_idx <= pps_tile_idx_delta_val[i] <= NumTilesInPic - 1 - tile_idx ses(pps_tile_idx_delta_val[i], - -current->num_tiles_in_pic + 1, - current->num_tiles_in_pic - 1, 1, i); + -tile_idx, current->num_tiles_in_pic - 1 - tile_idx, 1, i); if (current->pps_tile_idx_delta_val[i] == 0) { av_log(ctx->log_ctx, AV_LOG_ERROR, "pps_tile_idx_delta_val[i] shall not be equal to 0.\n"); |