This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new a809a784ec lavc/vvc: Prevent OOB write in sh_entry_points
a809a784ec is described below
commit a809a784ec9ff9910161c6c9554a041941d6ccce
Author: Umar Pathan <[email protected]>
AuthorDate: Wed Aug 26 00:00:00 2026 +0000
Commit: michaelni <[email protected]>
CommitDate: Thu Sep 17 21:40:25 2026 +0000
lavc/vvc: Prevent OOB write in sh_entry_points
Fixes: out of array access
Fixes: Af5rtPnOunVT
Found-by: Umar Pathan (Umar0x)
Signed-off-by: Umar Pathan <[email protected]>
---
libavcodec/vvc/ps.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/libavcodec/vvc/ps.c b/libavcodec/vvc/ps.c
index c27c8a43c2..2a46680adb 100644
--- a/libavcodec/vvc/ps.c
+++ b/libavcodec/vvc/ps.c
@@ -1467,7 +1467,7 @@ static void sh_partition_constraints(VVCSH *sh, const
H266RawSPS *sps, const H26
sh->min_qt_size[CHROMA] = 1 << min_qt_log2_size_y[CHROMA];
}
-static void sh_entry_points(VVCSH *sh, const H266RawSPS *sps, const VVCPPS
*pps)
+static int sh_entry_points(VVCSH *sh, const H266RawSPS *sps, const VVCPPS *pps)
{
if (sps->sps_entry_point_offsets_present_flag) {
for (int i = 1, j = 0; i < sh->num_ctus_in_curr_slice; i++) {
@@ -1478,10 +1478,14 @@ static void sh_entry_points(VVCSH *sh, const H266RawSPS
*sps, const VVCPPS *pps)
if (pps->ctb_to_row_bd[ctb_addr_y] !=
pps->ctb_to_row_bd[pre_ctb_addr_y] ||
pps->ctb_to_col_bd[ctb_addr_x] !=
pps->ctb_to_col_bd[pre_ctb_addr_x] ||
(ctb_addr_y != pre_ctb_addr_y &&
sps->sps_entropy_coding_sync_enabled_flag)) {
+ if (j >= VVC_MAX_ENTRY_POINTS)
+ return AVERROR_INVALIDDATA;
sh->entry_point_start_ctu[j++] = i;
}
}
}
+
+ return 0;
}
static int sh_derive(VVCSH *sh, const VVCFrameParamSets *fps)
@@ -1501,7 +1505,9 @@ static int sh_derive(VVCSH *sh, const VVCFrameParamSets
*fps)
sh_qp_y(sh, pps, ph);
sh_deblock_offsets(sh);
sh_partition_constraints(sh, sps, ph);
- sh_entry_points(sh, sps, fps->pps);
+ ret = sh_entry_points(sh, sps, fps->pps);
+ if (ret < 0)
+ return ret;
return 0;
}
--
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
