From patchwork Mon Feb 5 18:00:05 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Frank Plowman X-Patchwork-Id: 46049 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:7b08:b0:19e:8a94:b663 with SMTP id s8csp915292pzh; Mon, 5 Feb 2024 10:00:30 -0800 (PST) X-Google-Smtp-Source: AGHT+IHXyJXO8xzWswLA/BBkc3CG3+nG/27wPSr+XMj+A+91ES1lpSr0fzYmoaQCQADebJ/CzfNP X-Received: by 2002:a19:c50d:0:b0:511:5711:4f35 with SMTP id w13-20020a19c50d000000b0051157114f35mr265268lfe.23.1707156030604; Mon, 05 Feb 2024 10:00:30 -0800 (PST) X-Forwarded-Encrypted: i=1; AJvYcCVHpDdpVApNKk+q5w/zm3IHXMo2585TNlwJIDbZsro7zJoxuQcaPML2Szy8qiXammCwV14BTrEjh4zThFcWho/X7pt/1g7YngVJEYXOVvpA7zaZN2eVJhwswuEPSd2ktK5V4Fcj4QnONS6laEKLg7ZIwdBU4sPd4/6JIbSifVaxPDbeFLse54bFN5aZFhNILM54qh8IK0lYfr+sGJQ56bmPWenaivAVmVSjlaQFpS55GzPue55HVS9kSLD8c6LtCNP9W8/ItAHXbU1JDkkMGOQjTqWqEPzMDni7OtvUWJoP/ByrzDiMX+xge5rWxA7eNUSFpVkycOloaQBR+iO0Z6qpdUdJgPaEsWMmgkKC1bWhk9aLmRzTN/xeIkVzeR1G6ZucX4dVuRE0/fEAAiu37/wbpgiLTLBfhKPdAB7IL3KVtjAY0ZFAFWYiENfQT6XoAvxFWGdBm6vwbtYQpr7qaQkdfLVUOrJafZ2yzSjNCmm0aQe1z9qDsNpXpL+eBlhP1i9n/nAigEpstK+kQSOPrEuxK7o77Q+ZKeLD3D0WQnD7QcJLJefgMhlgaT+AOc88cBXGiy005WYfc/lVtX2VpDm/c9A2ue41yHa5rgJEMCwPtGumi8FlhHGMG1CFfsNyyqNlKeriEjRvLjGW5tvPF6tZ6r5JPWAeFXoZT4YpfnZZTSjrGswZNyn2e9s/7Zj64c24BBICGK3yBj3RLK3L9bKYh29QAoc14VnFLHNSUDB2tScvnyrB7sbdxeZTulBIiiDU1eDd/CU4Xojtv2WRF+SdKfYtJ/1s4e3IamHhnX5tiB7Im94mKpHaHwV4QY47K9l+032+B0YIklpJNd1b9x7zz/VF7VSp6ZokT0FK05F1JnUFO2h9L1ugGFR4Up55NpIOqiQvrGMoWPZ1+JBTtGTCRh3YfuDL/B8CJ5pm06ynFbdNuuCa466rYiwDsC96wE8m49 7oNHG36aAv8AcCOxCuUEUb5siaSGgZlnNEcoTZpSxOdwTiEZ0iOftkK8wCjAGlx/6TErLGbNSVXTUDcHv5vbNMR9RJzKCS1VTLqUX4PcpY43432HNmKH0LAqm58lmv2GRmZnySvwBhHCJDZdep4D+I/HHsy85tJy36BAm/Mqv1CEEuIqbZMOnnF+Oy0V/NhC487ZV/4m6HK+KXvdZmxcTaB9aAh/gc+a7FJSKzDyqD5BCPVi2PrRzdRz5srJMmUYmXC6PpvE5/LnPr3m5MPwQWXmSFwnuUZsx55Zbkmrxfkc9auBJM6xL8qTo7TEk4KgiqPtDzqFnkypFRfQm2yFL8ikxg9EYvPtkIjCltLTRw/pTSUQKXzXIeJsZZ4+4kKOFUzFPG33+PS44S1Sq1D1s4xVfDgRwUNXfg4uC11L1dW1wF3gBDZMPEVpQKUN3HprCbsREHaK9oudXP60LVjW2HERL5dvmFEWuwcXcAjcxrRUWu7y8jTmWX0YekyvmJFOMfYVj4cYwmSkih1Qb7SlyJhD1FXhg31Jd8K1Pp1yvL3HwjBW2HC7s8ydHC/X1rM9IQ/Y5yPYRruorKcKA0xkA+WHDRzw+MAQZdCRZ6+SSMaBwBTZZDFTXtFmmeBHK6X+5jNC0= Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id j17-20020a170906475100b00a37ebd12293si72430ejs.547.2024.02.05.10.00.29; Mon, 05 Feb 2024 10:00:30 -0800 (PST) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@frankplowman.com header.s=zmail header.b=Z+2NFQ8Y; arc=fail (body hash mismatch); spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 5E2FC68CE23; Mon, 5 Feb 2024 20:00:26 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from sender21-mail.zoho.eu (sender11-op-o12.zoho.eu [31.186.226.226]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id DF39F68CA64 for ; Mon, 5 Feb 2024 20:00:19 +0200 (EET) Delivered-To: post@frankplowman.com ARC-Seal: i=1; a=rsa-sha256; t=1707156018; cv=none; d=zohomail.eu; s=zohoarc; b=T43ZAm+9e8Vu46zLh2e/zXGuhcymmuXh9zTYUernUIItVM2iOJV5/H1poe3nWcH+HWtEgaEhZYLkj0h0WDZCZjHg222+edDW7bGt9FTDxhDGP7lA+oTa3rMpPb7J7GWtwv1s49Pkzv1mNxMlOyO4zuZd0YDO3/L6hyDywilf8nQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.eu; s=zohoarc; t=1707156018; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=K9zA1bjJRNA2BOiwzFMxhmLTOx2kQtO07+snuVwTmF8=; b=Px85lFHpSyzf7haapVnEMOXsWFGC2Q7C5xygfxOXlFu/BD9a8ZFKPID9NpoeLFXo2fBiqhf+EIc2ocVwpNS2WbBjboc60D+diWhyc8mFUNqslxiClLGNQlR/0XUOYTAMu9Ag4uqNQZD8bKYoY7n1MKfzsHyy9wkLk4VAYwhrFh8= ARC-Authentication-Results: i=1; mx.zohomail.eu; dkim=pass header.i=frankplowman.com; spf=pass smtp.mailfrom=post@frankplowman.com; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1707156018; s=zmail; d=frankplowman.com; i=post@frankplowman.com; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=K9zA1bjJRNA2BOiwzFMxhmLTOx2kQtO07+snuVwTmF8=; b=Z+2NFQ8YKUsmyx+975sngnYVaqz1MDFVHCZSKDGd5BugpbUmht2+9/KrTZC9YY1i hcwGsrD9vc8tCSJ5/FYyoie2MLDGH86bKq9hIr2ojrDxPJbL8rk9CAwkUNDQKJYgnXN G9v4hfqaYnRJnmnmoJ/yUAjvyj8AyccUdeeIaJ5c= Received: from localhost.localdomain (frankplowman.com [51.89.148.29]) by mx.zoho.eu with SMTPS id 1707156015586252.45122230904815; Mon, 5 Feb 2024 19:00:15 +0100 (CET) From: post@frankplowman.com To: ffmpeg-devel@ffmpeg.org Date: Mon, 5 Feb 2024 18:00:05 +0000 Message-ID: <20240205180005.12440-1-post@frankplowman.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-ZohoMailClient: External Subject: [FFmpeg-devel] [PATCH] lavc/vvc: Fix slice_idx out-of-bounds memset X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Frank Plowman Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: LcHn+96LpfWY From: Frank Plowman If the number of CTUs reduces between one picture and the next, the slice_idx table is reduced in size in the frame_context_for_each_tl call on vvcdec.c:321. When initialising the slice_idx table on vvcdec.c:325, the old code uses fc->tab.sz.ctu_count when calculating the table size. fc->tab.sz.ctu_count holds the old ctu count at this point however, not being updated to hold the new ctu count until vvcdec.c:342. This causes an out-of-bounds write. Patch fixes the problem by using pps->ctb_count, which was just used when allocating the table, in place of fc->tab.sz.ctu_count when initialising the table. Signed-off-by: Frank Plowman --- libavcodec/vvc/vvcdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/vvc/vvcdec.c b/libavcodec/vvc/vvcdec.c index 1a050600eb..8163b5ecb6 100644 --- a/libavcodec/vvc/vvcdec.c +++ b/libavcodec/vvc/vvcdec.c @@ -322,7 +322,7 @@ static int pic_arrays_init(VVCContext *s, VVCFrameContext *fc) if (ret < 0) return ret; - memset(fc->tab.slice_idx, -1, sizeof(*fc->tab.slice_idx) * fc->tab.sz.ctu_count); + memset(fc->tab.slice_idx, -1, sizeof(*fc->tab.slice_idx) * ctu_count); if (fc->tab.sz.ctu_count != ctu_count) { ff_refstruct_pool_uninit(&fc->rpl_tab_pool);