From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 35A594764A for ; Fri, 15 Sep 2023 15:02:01 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id B60B368C77C; Fri, 15 Sep 2023 18:01:59 +0300 (EEST) Received: from relay1-d.mail.gandi.net (relay1-d.mail.gandi.net [217.70.183.193]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id DE04468C690 for ; Fri, 15 Sep 2023 18:01:52 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id 3E979240002 for ; Fri, 15 Sep 2023 15:01:51 +0000 (UTC) Date: Fri, 15 Sep 2023 17:01:51 +0200 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20230915150151.GV8640@pb2> References: <20230915131147.5945-1-michael@niedermayer.cc> <20230915131147.5945-2-michael@niedermayer.cc> <55fe7d49-901c-5055-61e2-975599a903f8@gmail.com> MIME-Version: 1.0 In-Reply-To: <55fe7d49-901c-5055-61e2-975599a903f8@gmail.com> X-GND-Sasl: michael@niedermayer.cc Subject: Re: [FFmpeg-devel] [PATCH 2/4] avcodec/evc_ps: Check ref_pic_num and sps_max_dec_pic_buffering_minus1 X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============2079751093510665207==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============2079751093510665207== Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="SuGb6p5JEpzYJdwO" Content-Disposition: inline --SuGb6p5JEpzYJdwO Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Sep 15, 2023 at 10:57:29AM -0300, James Almer wrote: > On 9/15/2023 10:11 AM, Michael Niedermayer wrote: > > Fixes: out of array write > >=20 > > Found-by: dongsookim@korea.ac.kr > > Signed-off-by: Michael Niedermayer > > --- > > libavcodec/evc_ps.c | 13 +++++++++---- > > 1 file changed, 9 insertions(+), 4 deletions(-) > >=20 > > diff --git a/libavcodec/evc_ps.c b/libavcodec/evc_ps.c > > index 7fe13fd32f0..96237ed2911 100644 > > --- a/libavcodec/evc_ps.c > > +++ b/libavcodec/evc_ps.c > > @@ -22,12 +22,15 @@ > > #include "evc_ps.h" > > #define EXTENDED_SAR 255 > > - > > // @see ISO_IEC_23094-1 (7.3.7 Reference picture list structure synta= x) > > -static int ref_pic_list_struct(GetBitContext *gb, RefPicListStruct *rp= l) > > +static int ref_pic_list_struct(EVCParserSPS *sps, GetBitContext *gb, R= efPicListStruct *rpl) > > { > > uint32_t delta_poc_st, strp_entry_sign_flag =3D 0; > > rpl->ref_pic_num =3D get_ue_golomb_long(gb); > > + > > + if ((unsigned)rpl->ref_pic_num > sps->sps_max_dec_pic_buffering_m= inus1) > > + return AVERROR_INVALIDDATA; > > + > > if (rpl->ref_pic_num > 0) { > > delta_poc_st =3D get_ue_golomb_long(gb); > > @@ -251,6 +254,8 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSet= s *ps) > > sps->max_num_tid0_ref_pics =3D get_ue_golomb_31(gb); > > else { > > sps->sps_max_dec_pic_buffering_minus1 =3D get_ue_golomb_long(= gb); > > + if ((unsigned)sps->sps_max_dec_pic_buffering_minus1 > 16 - 1) > > + return AVERROR_INVALIDDATA; > > sps->long_term_ref_pic_flag =3D get_bits1(gb); > > sps->rpl1_same_as_rpl0_flag =3D get_bits1(gb); > > sps->num_ref_pic_list_in_sps[0] =3D get_ue_golomb(gb); > > @@ -261,7 +266,7 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSet= s *ps) > > } > > for (int i =3D 0; i < sps->num_ref_pic_list_in_sps[0]; ++i) > > - ref_pic_list_struct(gb, &sps->rpls[0][i]); > > + ref_pic_list_struct(sps, gb, &sps->rpls[0][i]); >=20 > Could check and propagate the error value here while at it. >=20 > > if (!sps->rpl1_same_as_rpl0_flag) { > > sps->num_ref_pic_list_in_sps[1] =3D get_ue_golomb(gb); > > @@ -270,7 +275,7 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSet= s *ps) > > goto fail; > > } > > for (int i =3D 0; i < sps->num_ref_pic_list_in_sps[1]; ++= i) > > - ref_pic_list_struct(gb, &sps->rpls[1][i]); > > + ref_pic_list_struct(sps, gb, &sps->rpls[1][i]); >=20 > Ditto. >=20 > > } > > } >=20 > Should be ok. will apply with these changes thx [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB "I am not trying to be anyone's saviour, I'm trying to think about the future and not be sad" - Elon Musk --SuGb6p5JEpzYJdwO Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEIAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCZQRx2wAKCRBhHseHBAsP q5SiAJ4x05JWG7Y56Y5rDn19kHvUbft+WgCfYgGDTW42myNUmSEBSdZbQpMAC4E= =Rq3a -----END PGP SIGNATURE----- --SuGb6p5JEpzYJdwO-- --===============2079751093510665207== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============2079751093510665207==--