From patchwork Wed May 17 17:28:54 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 41701 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:ba91:b0:105:feb:71f2 with SMTP id fb17csp1386125pzb; Wed, 17 May 2023 10:29:32 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6BZ19vsJ+/mGdgFBX2S9Zb969VAdajrOrd0QG3VCW3JthVThCoGySEmeKJ9bVhbOnxW/EB X-Received: by 2002:aa7:cc1a:0:b0:50d:56df:fca7 with SMTP id q26-20020aa7cc1a000000b0050d56dffca7mr3050072edt.6.1684344572143; Wed, 17 May 2023 10:29:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1684344572; cv=none; d=google.com; s=arc-20160816; b=IUkrjVcgIS0xAOdmijGqt6YFUhRCOaPGOwGl3w7ucbRgOzg5LtiC6uQJqbCADKLr7i RbSY7Sc+7ChfIUSTZJ93wE2+aSzIvduLlXXpoa7xH/zTd/XJC6g3+AcGBTiyptvr1753 /wBLQyaU57iprNdauJEyVepV/1vK6a3eJHrDrLI792lo20D1EcnsBoJCmoDI9f1+mJvd 1VeWBwZSG7KtzGs9cnXCKmgP5AxFqA1nYAusfYZe9OJf0x9kTmP4DFSzEBW/bMWaJ1YU 0newvqfu2mNSn8M7PFvt2DjY9jleL8UWXQlBQh5ARS6G4rQkpF3agYwOmYpQMhZsL+1D 0dDg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:mime-version:cc:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:message-id:date:to:from:delivered-to; bh=IexQOPLAUN/yxPlAsnxRHqw2MsjZicbSj8cjqa95riI=; b=UdB/0LT/C3gMSGpJw908574OGnzloF+ksfCIWZMVAmoeIPPaePHmKN0XJUH+QLYTE2 +ZxF3nq5qgul5UKQpPwAowVTNY6/kAQg66yy/cSibHhsZl/tb6CNRUDtd22cZwn9nhOW KmTFgBvJnuOYO/iJE7KaIT0BPSS0FPmCZSoWE53rMGHsShxDx8YWs/yhWvIaGwmHbWlD fclByz14QfOza3hvJPiKLTPs2/ytbvLrFPuAKqrhnCgNKt7ulkRmIwvAQ8Q7okt4Tcn/ Z+NxWWAv3GtSrP9ob+e4BxWTxgS7H2fyycPt7n3Or6t2vciNId7hFKSLTzVG5qfgq87T DTFQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id c6-20020aa7c746000000b0050bc725883fsi14806802eds.572.2023.05.17.10.29.08; Wed, 17 May 2023 10:29:32 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 6340A68C0FE; Wed, 17 May 2023 20:29:04 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from relay2-d.mail.gandi.net (relay2-d.mail.gandi.net [217.70.183.194]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id A46BC68C0A8 for ; Wed, 17 May 2023 20:28:57 +0300 (EEST) Received: (Authenticated sender: michael@niedermayer.cc) by mail.gandi.net (Postfix) with ESMTPSA id 70AFF40009; Wed, 17 May 2023 17:28:56 +0000 (UTC) From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Wed, 17 May 2023 19:28:54 +0200 Message-Id: <20230517172854.16598-1-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 Subject: [FFmpeg-devel] [PATCH] avcodec/hevc_ps: add proper bound checks around cm_ref_layer_id in colour_mapping_table. X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Clement Lecigne MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: v/ajEkKlNoIs From: Clement Lecigne Signed-off-by: Michael Niedermayer --- libavcodec/hevc_ps.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c index a55bced0f7..313ebef151 100644 --- a/libavcodec/hevc_ps.c +++ b/libavcodec/hevc_ps.c @@ -1374,9 +1374,14 @@ static void colour_mapping_octants(GetBitContext *gb, HEVCPPS *pps, int inp_dept } } -static void colour_mapping_table(GetBitContext *gb, HEVCPPS *pps) +static int colour_mapping_table(GetBitContext *gb, AVCodecContext *avctx, HEVCPPS *pps) { - pps->num_cm_ref_layers_minus1 = get_ue_golomb_long(gb); + pps->num_cm_ref_layers_minus1 = get_ue_golomb(gb); + if (pps->num_cm_ref_layers_minus1 >= 63U) { + av_log(avctx, AV_LOG_ERROR, + "num_cm_ref_layers_minus1 shall be in the range [0, 63].\n"); + return AVERROR_INVALIDDATA; + } for (int i = 0; i <= pps->num_cm_ref_layers_minus1; i++) pps->cm_ref_layer_id[i] = get_bits(gb, 6); @@ -1397,6 +1402,7 @@ static void colour_mapping_table(GetBitContext *gb, HEVCPPS *pps) } colour_mapping_octants(gb, pps, 0, 0, 0, 0, 1 << pps->cm_octant_depth); + return 0; } static int pps_multilayer_extension(GetBitContext *gb, AVCodecContext *avctx, @@ -1439,8 +1445,11 @@ static int pps_multilayer_extension(GetBitContext *gb, AVCodecContext *avctx, } pps->colour_mapping_enabled_flag = get_bits1(gb); - if (pps->colour_mapping_enabled_flag) - colour_mapping_table(gb, pps); + if (pps->colour_mapping_enabled_flag) { + int ret = colour_mapping_table(gb, avctx, pps); + if (ret < 0) + return ret; + } return 0; }