PR #25045 opened by vigneshvg URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25045 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25045.patch
Make sure that none of the denominators that are used for division are zero. Return an error if any of them is zero. Signed-off-by: Vignesh Venkatasubramanian <[email protected]> >From e51cdf3cb92590057923da4a72c7b353cfc296e4 Mon Sep 17 00:00:00 2001 From: Vignesh Venkat <[email protected]> Date: Tue, 13 Oct 2026 13:12:15 -0700 Subject: [PATCH] avutil/hdr_dynamic_metadata: Validate hdr10+ metadata Make sure that none of the denominators that are used for division are zero. Return an error if any of them is zero. Signed-off-by: Vignesh Venkatasubramanian <[email protected]> --- libavutil/hdr_dynamic_metadata.c | 58 ++++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) diff --git a/libavutil/hdr_dynamic_metadata.c b/libavutil/hdr_dynamic_metadata.c index 9b46499343..7a82541522 100644 --- a/libavutil/hdr_dynamic_metadata.c +++ b/libavutil/hdr_dynamic_metadata.c @@ -234,6 +234,62 @@ int av_dynamic_hdr_plus_from_t35(AVDynamicHDRPlus *s, const uint8_t *data, return 0; } +// Returns 1 if any denominator used by av_dynamic_hdr_plus_to_t35() is zero. +static int has_zero_denominator(const AVDynamicHDRPlus *s) +{ + for (int w = 1; w < s->num_windows; w++) { + if (!s->params[w].window_upper_left_corner_x.den || + !s->params[w].window_upper_left_corner_y.den || + !s->params[w].window_lower_right_corner_x.den || + !s->params[w].window_lower_right_corner_y.den) + return 1; + } + + if (!s->targeted_system_display_maximum_luminance.den) + return 1; + if (s->targeted_system_display_actual_peak_luminance_flag) { + for (int i = 0; i < s->num_rows_targeted_system_display_actual_peak_luminance; i++) + for (int j = 0; j < s->num_cols_targeted_system_display_actual_peak_luminance; j++) + if (!s->targeted_system_display_actual_peak_luminance[i][j].den) + return 1; + } + + for (int w = 0; w < s->num_windows; w++) { + for (int i = 0; i < 3; i++) + if (!s->params[w].maxscl[i].den) + return 1; + if (!s->params[w].average_maxrgb.den) + return 1; + for (int i = 0; i < s->params[w].num_distribution_maxrgb_percentiles; i++) + if (!s->params[w].distribution_maxrgb[i].percentile.den) + return 1; + if (!s->params[w].fraction_bright_pixels.den) + return 1; + } + + if (s->mastering_display_actual_peak_luminance_flag) { + for (int i = 0; i < s->num_rows_mastering_display_actual_peak_luminance; i++) + for (int j = 0; j < s->num_cols_mastering_display_actual_peak_luminance; j++) + if (!s->mastering_display_actual_peak_luminance[i][j].den) + return 1; + } + + for (int w = 0; w < s->num_windows; w++) { + if (s->params[w].tone_mapping_flag) { + if (!s->params[w].knee_point_x.den || !s->params[w].knee_point_y.den) + return 1; + for (int i = 0; i < s->params[w].num_bezier_curve_anchors; i++) + if (!s->params[w].bezier_curve_anchors[i].den) + return 1; + } + if (s->params[w].color_saturation_mapping_flag && + !s->params[w].color_saturation_weight.den) + return 1; + } + + return 0; +} + int av_dynamic_hdr_plus_to_t35(const AVDynamicHDRPlus *s, uint8_t **data, size_t *size) { uint8_t *buf; @@ -244,6 +300,8 @@ int av_dynamic_hdr_plus_to_t35(const AVDynamicHDRPlus *s, uint8_t **data, size_t return AVERROR(EINVAL); if ((!data || *data) && !size) return AVERROR(EINVAL); + if (has_zero_denominator(s)) + return AVERROR(EINVAL); /** * Buffer size per CTA-861-H p.253-254: -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
