From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 2EC454BCA8 for ; Sun, 2 Feb 2025 12:11:10 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 710DA68C23D; Sun, 2 Feb 2025 14:11:06 +0200 (EET) Received: from sender-op-o11.zoho.eu (sender-op-o11.zoho.eu [136.143.169.11]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 293DB68B8A3 for ; Sun, 2 Feb 2025 14:11:00 +0200 (EET) ARC-Seal: i=1; a=rsa-sha256; t=1738498256; cv=none; d=zohomail.eu; s=zohoarc; b=Nss9ThwcZuFItCOOjgYW0o67VEyTFMCu1Nwa6oA7Wy1/C6mOunxY8z9c+QVRDNL1LSACh8918EfZZnoWl+KioyBND88/TUZHbX55HiTBHJ93XK2J6ydSPRYpCijaY5RhLaEmjVWFHzNPQvP+j56nNGR3RhBEhjOrkf6nDZYOaOA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.eu; s=zohoarc; t=1738498256; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=dZZ+o5vzYvXXF3YxLnD3Aa+NJMOh8GKTf1u3G1i3X+U=; b=UuIInohLCJsRiLIqbXmzANCo9TaxDdcPIfBXe7N7lCN/S58vyQdNg+2QREaiRVYa9EtHm+9SEU795OgS6KU+uqpm7vGOYvrlmD0LZ1dHFweAkji4aQJUDpJLWh5B4oOfua6/ADxl6Dzi0QnBBkc+kqtEqpCe1K2Pi78D+Rcy/LU= ARC-Authentication-Results: i=1; mx.zohomail.eu; dkim=pass header.i=frankplowman.com; spf=pass smtp.mailfrom=post@frankplowman.com; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1738498256; s=zmail; d=frankplowman.com; i=post@frankplowman.com; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=dZZ+o5vzYvXXF3YxLnD3Aa+NJMOh8GKTf1u3G1i3X+U=; b=K0UUb/N/NB2zpNa9n82Jm7moleHLN+fQ+ntqiZWz/ERlRRCGTYv94WQyIzm7rboZ D4WtQSj3xUVZ7EiWSRlD0pUtsB1eSSTC4lbywaVspGdPNN/ChzkgcF/6ywnxa8tbkxO 7LD9rTUR0Beopx2INh7xOk8sJ9ePviHb8kx7+QCI= Received: by mx.zoho.eu with SMTPS id 1738498255533852.5098785023471; Sun, 2 Feb 2025 13:10:55 +0100 (CET) From: Frank Plowman To: ffmpeg-devel@ffmpeg.org Date: Sun, 2 Feb 2025 12:10:48 +0000 Message-ID: <20250202121053.17147-1-post@frankplowman.com> X-Mailer: git-send-email 2.47.0 MIME-Version: 1.0 X-ZohoMailClient: External Subject: [FFmpeg-devel] [PATCH] lavc/vvc: Fix derivation of inverse LMCS idx X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Frank Plowman , nuomi2021@gmail.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: The clamping of idxYInv from H.266(V3) section 8.8.2.3 was missing. This could lead to OOB reads from lmcs->pivot or input_pivot. I also changed the derivation of the forward LMCS idx to use a shift rather than a division for speed and as this is actually how the variable is declared in the specification (8.7.5.2). Signed-off-by: Frank Plowman --- libavcodec/vvc/ps.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/vvc/ps.c b/libavcodec/vvc/ps.c index 01b4615eda..fae6655cc0 100644 --- a/libavcodec/vvc/ps.c +++ b/libavcodec/vvc/ps.c @@ -786,7 +786,7 @@ static int lmcs_derive_lut(VVCLMCS *lmcs, const H266RawAPS *rlmcs, const H266Raw //derive lmcs_fwd_lut for (uint16_t sample = 0; sample < max; sample++) { - const int idx_y = sample / org_cw; + const int idx_y = sample >> shift; const uint16_t fwd_sample = lmcs_derive_lut_sample(sample, lmcs->pivot, input_pivot, scale_coeff, idx_y, max); if (bit_depth > 8) @@ -802,6 +802,7 @@ static int lmcs_derive_lut(VVCLMCS *lmcs, const H266RawAPS *rlmcs, const H266Raw uint16_t inv_sample; while (i <= lmcs->max_bin_idx && sample >= lmcs->pivot[i + 1]) i++; + i = FFMIN(i, LMCS_MAX_BIN_SIZE - 1); inv_sample = lmcs_derive_lut_sample(sample, input_pivot, lmcs->pivot, inv_scale_coeff, i, max); -- 2.47.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".