From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id E8F6F4F23E for ; Sat, 17 May 2025 21:05:36 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id AE63568D96C; Sun, 18 May 2025 00:05:33 +0300 (EEST) Received: from sender2-op-o11.zoho.eu (sender2-op-o11.zoho.eu [136.143.171.11]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id E1F0268D8E7 for ; Sun, 18 May 2025 00:05:26 +0300 (EEST) ARC-Seal: i=1; a=rsa-sha256; t=1747515919; cv=none; d=zohomail.eu; s=zohoarc; b=IAl22j6RFaWe6Xfk+O1FivkR9oWJpvV9c3Zf2jxHsAHlaFRz+9nk1ECzHymVO3KEw2OsWoZpdz1B07yF9F4N0nrKmW5qS+SMx27T9rUsCEKuhJMFNFky7AsLNUEcBraSkqH7P0aoOBCUOcd071wf8P1vBHvj7PNAkET7Hv7DHZ8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.eu; s=zohoarc; t=1747515919; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=JFqMFOy3fvi4u7lLJPp/Egwle2n27EtcVnacVKMCfgM=; b=XxAlWk+WnX3KblmOLxgHs46AW2aDcWmi4e+ntYcMta1WIl2UPPk0v0L16YxcuzPCSnyfGtdPgNJwp25Oon7BTd986RznUOt0IHxKyebjE+sKU5WF5tiQvyOt08A+EpAA110aFO+ZMX0YDZyWoJdFZgLbsMnApFePv549jK4rNh0= ARC-Authentication-Results: i=1; mx.zohomail.eu; dkim=pass header.i=frankplowman.com; spf=pass smtp.mailfrom=post@frankplowman.com; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1747515919; s=zmail; d=frankplowman.com; i=post@frankplowman.com; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=JFqMFOy3fvi4u7lLJPp/Egwle2n27EtcVnacVKMCfgM=; b=D1o8hZPp/d1Q9WaXFFrc+QnzH1rQDKsHY0ZFG9zNQ+HmFKHHm7LXIVZldEwxasn5 Dd1aL9/z3ZNRioURFPaDU6ULtT9kA2bVEw9jRpoIKkkpDavbvIHjEytI/YJzD7csj/i sJaiOP5sdKEZWxyaWKOLOxAhyAgUxa1chIR5b3UY= Received: by mx.zoho.eu with SMTPS id 1747515918371855.3758064670859; Sat, 17 May 2025 23:05:18 +0200 (CEST) From: Frank Plowman To: ffmpeg-devel@ffmpeg.org Date: Sat, 17 May 2025 22:03:56 +0100 Message-ID: <20250517210515.8726-1-post@frankplowman.com> X-Mailer: git-send-email 2.47.0 MIME-Version: 1.0 X-ZohoMailClient: External Subject: [FFmpeg-devel] [PATCH v1] lavc/vvc: Validate num_signalled_palette_entries X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Frank Plowman , nuomi2021@gmail.com, toqsxw@outlook.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: "The value of CurrentPaletteSize[ startComp ] shall be in the range of 0 to maxNumPaletteEntries, inclusive." Signed-off-by: Frank Plowman --- libavcodec/vvc/ctu.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c index 62c9d4f5c0..70800ba5fa 100644 --- a/libavcodec/vvc/ctu.c +++ b/libavcodec/vvc/ctu.c @@ -20,6 +20,7 @@ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ +#include "libavutil/error.h" #include "libavutil/refstruct.h" #include "cabac.h" @@ -1873,7 +1874,7 @@ static void palette_predicted(VVCLocalContext *lc, const bool local_dual_tree, i cu->plt[c].size = nb_predicted; } -static void palette_signaled(VVCLocalContext *lc, const bool local_dual_tree, +static int palette_signaled(VVCLocalContext *lc, const bool local_dual_tree, const int start, const int end, const int max_entries) { const VVCSPS *sps = lc->fc->ps.sps; @@ -1883,6 +1884,9 @@ static void palette_signaled(VVCLocalContext *lc, const bool local_dual_tree, const int size = nb_predicted + nb_signaled; const bool dual_tree_luma = local_dual_tree && cu->tree_type == DUAL_TREE_LUMA; + if (size > max_entries) + return AVERROR_INVALIDDATA; + for (int c = start; c < end; c++) { Palette *plt = cu->plt + c; for (int i = nb_predicted; i < size; i++) { @@ -1894,6 +1898,8 @@ static void palette_signaled(VVCLocalContext *lc, const bool local_dual_tree, } plt->size = size; } + + return 0; } static void palette_update_predictor(VVCLocalContext *lc, const bool local_dual_tree, int start, int end, @@ -2070,7 +2076,7 @@ static int hls_palette_coding(VVCLocalContext *lc, const VVCTreeType tree_type) int max_index = 0; int prev_run_pos = 0; - int predictor_size, start, end; + int predictor_size, start, end, ret; bool reused[VVC_MAX_NUM_PALETTE_PREDICTOR_SIZE]; uint8_t run_type[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE]; uint8_t index[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE]; @@ -2083,7 +2089,9 @@ static int hls_palette_coding(VVCLocalContext *lc, const VVCTreeType tree_type) predictor_size = pp[start].size; memset(reused, 0, sizeof(reused[0]) * predictor_size); palette_predicted(lc, local_dual_tree, start, end, reused, predictor_size, max_entries); - palette_signaled(lc, local_dual_tree, start, end, max_entries); + ret = palette_signaled(lc, local_dual_tree, start, end, max_entries); + if (ret < 0) + return ret; palette_update_predictor(lc, local_dual_tree, start, end, reused, predictor_size); if (cu->plt[start].size > 0) -- 2.47.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".