From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 2ADC64A7AA for ; Tue, 9 Apr 2024 09:11:50 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 67C0468C8C3; Tue, 9 Apr 2024 12:11:47 +0300 (EEST) Received: from wrqvffvh.outbound-mail.sendgrid.net (wrqvffvh.outbound-mail.sendgrid.net [149.72.255.128]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 01D4668CFEC for ; Tue, 9 Apr 2024 12:11:40 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=frankplowman.com; h=from:subject:mime-version:to:cc:content-transfer-encoding: content-type:cc:content-type:from:subject:to; s=s1; bh=W07hcFXWXytNJMQugfhew1Ja6age3GwB+5YCIU3RCXs=; b=IqcBMkVe2Qdth2XZcILQU4SqgC1PyacZ9Cg2sQUCxDCqBI4MT8LPSOAWKIe+c/r+31xi vkUjpvDQtyVc4RvCgiwyTiX66UGLtt+oRbxBFeC0A1dsiQYj+lwowIbr3GLCOGfCfV+xHV S5oWKIgURM8/wqt3JMBfVpmRy9Ofei4yaoyqGnNCGRpkSeMwBuOlVHw/+zRthUEW8OujM5 pAiHt2WB1hv3AOlA1H8s5GM0lEtY5Kc3whl52Jt5ml8uGFaH60zFfwzB2SOMs383aN/KFU T56+rsdEMEPpW65RuhaSdDZTR8t9jqhxPjT7off1t6vJJtaIDdsv0zKLMaMK4bPg== Received: by recvd-6fc499775c-sfjtq with SMTP id recvd-6fc499775c-sfjtq-1-6615064B-5 2024-04-09 09:11:39.428253824 +0000 UTC m=+1858355.942891699 Received: from localhost.localdomain (unknown) by geopod-ismtpd-11 (SG) with ESMTP id jrwB5JmvTfG2JzYOc5_f_A Tue, 09 Apr 2024 09:11:39.222 +0000 (UTC) From: Frank Plowman Date: Tue, 09 Apr 2024 09:11:39 +0000 (UTC) Message-ID: <20240409091134.57665-1-post@frankplowman.com> X-Mailer: git-send-email 2.44.0 MIME-Version: 1.0 X-SG-EID: =?us-ascii?Q?u001=2EZ0KJCHpts8tvDq7PHgz5cpqJ+vJcSmdTtST=2Fg91WT3qAbNxUpEMGIDQq9?= =?us-ascii?Q?1mXy3Yjvepp8fYsFUJzGsyhT1EwBbgeUjhjA1fv?= =?us-ascii?Q?5eTi5z=2Fn=2Fe08mTcl6IukSC3G8jTfkCU4Ube8uWq?= =?us-ascii?Q?NwDbcRdudyUiruFoSnxd1XrHNELhNwWO+ZWISMx?= =?us-ascii?Q?qo8f4bPIX4BOJCzNmhkJpw1EU+kEveqk2ik3mMe?= =?us-ascii?Q?fs=2FKTZsTT2zB0J9kmxqcYuvLMSqulWPDTs5C37+?= =?us-ascii?Q?Zw5l?= To: ffmpeg-devel@ffmpeg.org X-Entity-ID: u001.qzljkbu34TNIX4NwfTiKWA== Subject: [FFmpeg-devel] [PATCH] lavc/vvc: Fix out-of-bounds array access X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Frank Plowman Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: The 2 which has been changed to an 8 in the array length expression is the maximum value of sps_bitdepth_minus8. This was missed when updating to VVCv2, which increased this maximum from 2 to 8. Signed-off-by: Frank Plowman --- libavcodec/vvc/intra.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/libavcodec/vvc/intra.c b/libavcodec/vvc/intra.c index 5ac7d02c80..def113239b 100644 --- a/libavcodec/vvc/intra.c +++ b/libavcodec/vvc/intra.c @@ -339,18 +339,22 @@ static void derive_qp(const VVCLocalContext *lc, const TransformUnit *tu, Transf //8.7.3 Scaling process for transform coefficients static av_always_inline int derive_scale(const TransformBlock *tb, const int sh_dep_quant_used_flag) { - static const uint8_t rem6[63 + 2 * 6 + 1] = { + static const uint8_t rem6[63 + 8 * 6 + 1] = { 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, - 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3 + 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, + 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, + 0, 1, 2, 3, }; - static const uint8_t div6[63 + 2 * 6 + 1] = { + static const uint8_t div6[63 + 8 * 6 + 1] = { 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 2, 2, 2, 2, 2, 2, 3, 3, 3, 3, 3, 3, 4, 4, 4, 4, 4, 4, 5, 5, 5, 5, 5, 5, 6, 6, 6, 6, 6, 6, 7, 7, 7, 7, 7, 7, 8, 8, 8, 8, 8, 8, 9, 9, 9, 9, 9, 9, 10, 10, 10, 10, - 10, 10, 11, 11, 11, 11, 11, 11, 12, 12, 12, 12 + 10, 10, 11, 11, 11, 11, 11, 11, 12, 12, 12, 12, 12, 12, 13, 13, 13, 13, + 13, 13, 14, 14, 14, 14, 14, 14, 15, 15, 15, 15, 15, 15, 16, 16, 16, 16, + 16, 16, 17, 17, 17, 17, 17, 17, 18, 18, 18, 18, }; const static int level_scale[2][6] = { -- 2.44.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".