From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 220B045ED9 for ; Mon, 17 Apr 2023 14:17:15 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id CE44C6806EF; Mon, 17 Apr 2023 17:17:11 +0300 (EEST) Received: from mail-ot1-f41.google.com (mail-ot1-f41.google.com [209.85.210.41]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id C569768B1C4 for ; Mon, 17 Apr 2023 17:17:05 +0300 (EEST) Received: by mail-ot1-f41.google.com with SMTP id bu14-20020a0568300d0e00b0069fab3f4cafso12223724otb.9 for ; Mon, 17 Apr 2023 07:17:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1681741023; x=1684333023; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=H9ycPNamyrBDgq3dhyujnn3TWAn7TpVvl1CjSGZJaug=; b=OU/bQ7Bx4eahie4iRBdER/eUSG840IjGDKV/0P8pImawX+poj5lvSVVjCqKBFRsA50 GLI7DmQAPqDejuOh0kFyH+/HCHevwtWT+ZPJ+KMBsVUuWLpdlk3pLy3u2Y6Qg05Zu0Ud 4Rs5E13nrox1xdcpPFOe6PbKysDciatO8hrpP4Hec4W3I8r5Q5rYplO8ykahQqoz5v0U sgkKhMgcQmGYFAn94nfcdWDuNaiqmzT/WTs5HFgQ4+ls/eb7XFM6weLME9H38iXHOTcu HCBDOOc0p4JyitrZ5Cbe9DWeZ+EXOGURQj6zORAcJ+EE8N2lmwA8sCGsaqbQEAqxUYVX /gxw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1681741023; x=1684333023; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=H9ycPNamyrBDgq3dhyujnn3TWAn7TpVvl1CjSGZJaug=; b=R2s8p3dZIAjqDkyKRJai0KeQoPxdWIwfe4R5QuLel7+Xx0kr1oUzYlwoo+cR8fwgzK n1VtHXqyef8unHWptmWluIXwEKL9uVhPd7V4TNKqDOfiQFHPZmIWBd2yx2WZiWZfZDDJ G0AeToemVnwfEWAyraoOmKUTCim8zePGB5MfRwEeWCw8vPb9JQW7WTVUTBI7EhRl+R2Y QEhLRta3wPtlr4THKTns6j0TtkMBL+qwKvbI49NKNPf2GWrGdmDTc9Sh8uI4nHpciP/Y x72pbqZwvw5RK5XFqwJh4iTJY1Xjcavl1FdHngSTPEG39D6B4ttbiT6m4f6oppF5puQz LtBA== X-Gm-Message-State: AAQBX9ejtH5oGmI/c+Zxjia1eioWUr5Y2x7SFPxnNljyg4P9lZmAwewm 6PLyNdwcCGymXhMHgpo7ofu/586dSxo= X-Google-Smtp-Source: AKy350b/ZB9plziPaFxr0SLooP/OArJ57tWEUFV4AAGxa6ayRFk9KDGAPwmiZuRlUbY8/6I3tSV5XQ== X-Received: by 2002:a9d:7749:0:b0:6a5:f5ca:f36b with SMTP id t9-20020a9d7749000000b006a5f5caf36bmr18999otl.18.1681741023485; Mon, 17 Apr 2023 07:17:03 -0700 (PDT) Received: from localhost.localdomain (host197.190-225-105.telecom.net.ar. [190.225.105.197]) by smtp.gmail.com with ESMTPSA id q15-20020a9d4b0f000000b006a5edce01f4sm572123otf.26.2023.04.17.07.17.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 17 Apr 2023 07:17:02 -0700 (PDT) From: James Almer To: ffmpeg-devel@ffmpeg.org Date: Mon, 17 Apr 2023 11:16:45 -0300 Message-Id: <20230417141647.1129-1-jamrial@gmail.com> X-Mailer: git-send-email 2.40.0 MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH 1/3] avcodec/hevc_ps: further constrain allowed num_ref_loc_offsets values X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: The spec says: "The value of num_ref_loc_offsets shall be in the range of 0 to vps_max_layers_minus1, inclusive". Signed-off-by: James Almer --- libavcodec/hevc_ps.c | 13 +++++++------ libavcodec/hevc_ps.h | 2 +- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c index be1d668c26..69d5504ce1 100644 --- a/libavcodec/hevc_ps.c +++ b/libavcodec/hevc_ps.c @@ -1384,18 +1384,17 @@ static void colour_mapping_table(GetBitContext *gb, HEVCPPS *pps) } static int pps_multilayer_extension(GetBitContext *gb, AVCodecContext *avctx, - HEVCPPS *pps, HEVCSPS *sps) + HEVCPPS *pps, HEVCSPS *sps, HEVCVPS *vps) { pps->poc_reset_info_present_flag = get_bits1(gb); pps->pps_infer_scaling_list_flag = get_bits1(gb); if (pps->pps_infer_scaling_list_flag) pps->pps_scaling_list_ref_layer_id = get_bits(gb, 6); - pps->num_ref_loc_offsets = get_ue_golomb_long(gb); - if (pps->num_ref_loc_offsets > FF_ARRAY_ELEMS(pps->ref_loc_offset_layer_id)) { - pps->num_ref_loc_offsets = 0; + pps->num_ref_loc_offsets = get_ue_golomb(gb); + if (pps->num_ref_loc_offsets > vps->vps_max_layers - 1) return AVERROR_INVALIDDATA; - } + for (int i = 0; i < pps->num_ref_loc_offsets; i++) { pps->ref_loc_offset_layer_id[i] = get_bits(gb, 6); pps->scaled_ref_layer_offset_present_flag[i] = get_bits1(gb); @@ -1693,6 +1692,7 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx, HEVCParamSets *ps) { HEVCSPS *sps = NULL; + HEVCVPS *vps = NULL; int i, ret = 0; unsigned int pps_id = 0; ptrdiff_t nal_size; @@ -1753,6 +1753,7 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx, goto err; } sps = (HEVCSPS *)ps->sps_list[pps->sps_id]->data; + vps = (HEVCVPS *)ps->vps_list[sps->vps_id]->data; pps->dependent_slice_segments_enabled_flag = get_bits1(gb); pps->output_flag_present_flag = get_bits1(gb); @@ -1921,7 +1922,7 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx, } if (pps->pps_multilayer_extension_flag) { - if ((ret = pps_multilayer_extension(gb, avctx, pps, sps)) < 0) + if ((ret = pps_multilayer_extension(gb, avctx, pps, sps, vps)) < 0) goto err; } diff --git a/libavcodec/hevc_ps.h b/libavcodec/hevc_ps.h index 1f704108e3..184f87a001 100644 --- a/libavcodec/hevc_ps.h +++ b/libavcodec/hevc_ps.h @@ -314,7 +314,7 @@ typedef struct HEVCPPS { uint8_t poc_reset_info_present_flag; uint8_t pps_infer_scaling_list_flag; uint8_t pps_scaling_list_ref_layer_id; - uint16_t num_ref_loc_offsets; + uint8_t num_ref_loc_offsets; uint8_t ref_loc_offset_layer_id[64]; uint8_t scaled_ref_layer_offset_present_flag[64]; int8_t scaled_ref_layer_left_offset[64]; -- 2.40.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".