[FFmpeg-devel] [PATCH] lavc/vvc: Fix out-of-bounds array access

[FFmpeg-devel] [PATCH] lavc/vvc: Fix out-of-bounds array access

[Frank Plowman]

The 2 which has been changed to an 8 in the array length expression is
the maximum value of sps_bitdepth_minus8.  This was missed when updating
to VVCv2, which increased this maximum from 2 to 8.

Signed-off-by: Frank Plowman <post@frankplowman.com>
---
 libavcodec/vvc/intra.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/libavcodec/vvc/intra.c b/libavcodec/vvc/intra.c
index 5ac7d02c80..def113239b 100644
--- a/libavcodec/vvc/intra.c
+++ b/libavcodec/vvc/intra.c
@@ -339,18 +339,22 @@ static void derive_qp(const VVCLocalContext *lc, const TransformUnit *tu, Transf
 //8.7.3 Scaling process for transform coefficients
 static av_always_inline int derive_scale(const TransformBlock *tb, const int sh_dep_quant_used_flag)
 {
-    static const uint8_t rem6[63 + 2 * 6 + 1] = {
+    static const uint8_t rem6[63 + 8 * 6 + 1] = {
         0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2,
         3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5,
         0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3,
-        4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3
+        4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1,
+        2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5, 0, 1, 2, 3, 4, 5,
+        0, 1, 2, 3,
     };
 
-    static const uint8_t div6[63 + 2 * 6 + 1] = {
+    static const uint8_t div6[63 + 8 * 6 + 1] = {
         0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 2, 2, 2, 2, 2, 2, 3,  3,  3,
         3, 3, 3, 4, 4, 4, 4, 4, 4, 5, 5, 5, 5, 5, 5, 6, 6, 6, 6,  6,  6,
         7, 7, 7, 7, 7, 7, 8, 8, 8, 8, 8, 8, 9, 9, 9, 9, 9, 9, 10, 10, 10, 10,
-        10, 10, 11, 11, 11, 11, 11, 11, 12, 12, 12, 12
+        10, 10, 11, 11, 11, 11, 11, 11, 12, 12, 12, 12, 12, 12, 13, 13, 13, 13,
+        13, 13, 14, 14, 14, 14, 14, 14, 15, 15, 15, 15, 15, 15, 16, 16, 16, 16,
+        16, 16, 17, 17, 17, 17, 17, 17, 18, 18, 18, 18,
     };
 
     const static int level_scale[2][6] = {
-- 
2.44.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".