PR #25491 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25491 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25491.patch
A picture can hold up to 627264 CTUs (25332x25332 with 32x32 CTUs) and level 6.3 allows 78336 CTUs at that CTU size, but slice_start_offset and num_ctus_in_slice were 16 bit. A rectangular slice with more than 65535 CTUs, or starting after the 65535th CTU, was mapped to the wrong CTUs and the picture was rejected because its CTUs were not all covered exactly once. Rejected pictures Replicated through UnModified FFmpeg with ASAN Fixes: 4BDaLEwFScvp This allows reading outside the array but not outside allocated space Found-by: app.depthfirst.com >From 9141adcfbcd19120bf7326228f23a81104ac3a2a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 26 Oct 2026 15:57:23 +0100 Subject: [PATCH] avcodec/vvc/ps: widen the per slice CTU offset and count to 32 bits A picture can hold up to 627264 CTUs (25332x25332 with 32x32 CTUs) and level 6.3 allows 78336 CTUs at that CTU size, but slice_start_offset and num_ctus_in_slice were 16 bit. A rectangular slice with more than 65535 CTUs, or starting after the 65535th CTU, was mapped to the wrong CTUs and the picture was rejected because its CTUs were not all covered exactly once. Rejected pictures Replicated through UnModified FFmpeg with ASAN Fixes: 4BDaLEwFScvp This allows reading outside the array but not outside allocated space Found-by: app.depthfirst.com --- libavcodec/vvc/ps.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/vvc/ps.h b/libavcodec/vvc/ps.h index 90bd4c0e9ea..add8e22367b 100644 --- a/libavcodec/vvc/ps.h +++ b/libavcodec/vvc/ps.h @@ -99,8 +99,8 @@ typedef struct VVCPPS { uint16_t width; uint16_t height; - uint16_t slice_start_offset[VVC_MAX_SLICES]; - uint16_t num_ctus_in_slice [VVC_MAX_SLICES]; + uint32_t slice_start_offset[VVC_MAX_SLICES]; + uint32_t num_ctus_in_slice [VVC_MAX_SLICES]; uint16_t min_cb_width; uint16_t min_cb_height; -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
