| Message ID | AS8P250MB0744726A9B33410FA1ED1C1F8F522@AS8P250MB0744.EURP250.PROD.OUTLOOK.COM |
|---|---|
| State | Accepted |
| Commit | 1eafbc27e2d3824b2fd3123bd78c25bc60fed8ba |
| Headers | show |
| Series | [FFmpeg-devel,1/4] avcodec/vvc/vvc_ps: Check before access | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
Andreas Rheinhardt: > max_bin_idx can be at most LMCS_MAX_BIN_SIZE - 1 here, > so pivot[LCMS_MAX_BIN_SIZE + 1] may be accessed, > but pivot has only LCMS_MAX_BIN_SIZE + 1 elements > (unless the values of pivot were so that it is always > assured that pivot[LCMS_MAX_BIN_SIZE] is always < sample > (which it is iff it is always < 2^bit_depth - 1)). > So reorder the checks. > > Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> > --- > I don't know whether this can be triggered at all. > > libavcodec/vvc/vvc_ps.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavcodec/vvc/vvc_ps.c b/libavcodec/vvc/vvc_ps.c > index 53a86321d6..376027ed81 100644 > --- a/libavcodec/vvc/vvc_ps.c > +++ b/libavcodec/vvc/vvc_ps.c > @@ -652,7 +652,7 @@ static int lmcs_derive_lut(VVCLMCS *lmcs, const H266RawAPS *rlmcs, const H266Raw > i = lmcs->min_bin_idx; > for (uint16_t sample = 0; sample < max; sample++) { > uint16_t inv_sample; > - while (sample >= lmcs->pivot[i + 1] && i <= lmcs->max_bin_idx) > + while (i <= lmcs->max_bin_idx && sample >= lmcs->pivot[i + 1]) > i++; > > inv_sample = lmcs_derive_lut_sample(sample, input_pivot, lmcs->pivot, Will apply this patchset tomorrow unless there are objections. - Andreas
On Tue, Feb 20, 2024 at 7:24 AM Andreas Rheinhardt < andreas.rheinhardt@outlook.com> wrote: > Andreas Rheinhardt: > > max_bin_idx can be at most LMCS_MAX_BIN_SIZE - 1 here, > > so pivot[LCMS_MAX_BIN_SIZE + 1] may be accessed, > > but pivot has only LCMS_MAX_BIN_SIZE + 1 elements > > (unless the values of pivot were so that it is always > > assured that pivot[LCMS_MAX_BIN_SIZE] is always < sample > > (which it is iff it is always < 2^bit_depth - 1)). > > So reorder the checks. > > > > Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> > > --- > > I don't know whether this can be triggered at all. > > > > libavcodec/vvc/vvc_ps.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/libavcodec/vvc/vvc_ps.c b/libavcodec/vvc/vvc_ps.c > > index 53a86321d6..376027ed81 100644 > > --- a/libavcodec/vvc/vvc_ps.c > > +++ b/libavcodec/vvc/vvc_ps.c > > @@ -652,7 +652,7 @@ static int lmcs_derive_lut(VVCLMCS *lmcs, const > H266RawAPS *rlmcs, const H266Raw > > i = lmcs->min_bin_idx; > > for (uint16_t sample = 0; sample < max; sample++) { > > uint16_t inv_sample; > > - while (sample >= lmcs->pivot[i + 1] && i <= lmcs->max_bin_idx) > > + while (i <= lmcs->max_bin_idx && sample >= lmcs->pivot[i + 1]) > > i++; > > > > inv_sample = lmcs_derive_lut_sample(sample, input_pivot, > lmcs->pivot, > > Will apply this patchset tomorrow unless there are objections. LGTM for the enitre patchset. Thank you, Andreas! > > - Andreas > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". >
diff --git a/libavcodec/vvc/vvc_ps.c b/libavcodec/vvc/vvc_ps.c index 53a86321d6..376027ed81 100644 --- a/libavcodec/vvc/vvc_ps.c +++ b/libavcodec/vvc/vvc_ps.c @@ -652,7 +652,7 @@ static int lmcs_derive_lut(VVCLMCS *lmcs, const H266RawAPS *rlmcs, const H266Raw i = lmcs->min_bin_idx; for (uint16_t sample = 0; sample < max; sample++) { uint16_t inv_sample; - while (sample >= lmcs->pivot[i + 1] && i <= lmcs->max_bin_idx) + while (i <= lmcs->max_bin_idx && sample >= lmcs->pivot[i + 1]) i++; inv_sample = lmcs_derive_lut_sample(sample, input_pivot, lmcs->pivot,
max_bin_idx can be at most LMCS_MAX_BIN_SIZE - 1 here, so pivot[LCMS_MAX_BIN_SIZE + 1] may be accessed, but pivot has only LCMS_MAX_BIN_SIZE + 1 elements (unless the values of pivot were so that it is always assured that pivot[LCMS_MAX_BIN_SIZE] is always < sample (which it is iff it is always < 2^bit_depth - 1)). So reorder the checks. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> --- I don't know whether this can be triggered at all. libavcodec/vvc/vvc_ps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)