[FFmpeg-devel] [PATCH] avcodec/vvc: add boundary checks for CTU table access

[0xBat via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

In libavcodec/vvc/ctu.c, the functions set_tb_size and set_cb_pos lack proper boundary checks before performing memset operations. This patch adds validation against PPS dimensions to prevent heap overflows.

Signed-off-by: 0xBat <monsterbat02@gmail.com>
---
 libavcodec/vvc/ctu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c
index 18cbe0fe0f..ce8a7ab90e 100644
--- a/libavcodec/vvc/ctu.c
+++ b/libavcodec/vvc/ctu.c
@@ -52,6 +52,9 @@ static void set_tb_size(const VVCFrameContext *fc, const TransformBlock *tb)
 
     for (int y = y_tb; y < end; y++) {
         const int off = y * fc->ps.pps->min_tu_width + x_tb;
+        int max_off = fc->ps.pps->min_tu_width * fc->ps.pps->min_tu_height;
+        if (off + width > max_off)
+            return;
         memset(fc->tab.tb_width [is_chroma] + off, tb->tb_width,  width);
         memset(fc->tab.tb_height[is_chroma] + off, tb->tb_height, width);
     }
@@ -1185,6 +1188,8 @@ static void set_cb_pos(const VVCFrameContext *fc, const CodingUnit *cu)
             fc->tab.cb_pos_x[ch_type][x + i] = cu->x0;
             fc->tab.cb_pos_y[ch_type][x + i] = cu->y0;
         }
+        if (x + width > fc->ps.pps->min_tu_width * fc->ps.pps->min_tu_height)
+            return;
         memset(&fc->tab.cb_width[ch_type][x], cu->cb_width, width);
         memset(&fc->tab.cb_height[ch_type][x], cu->cb_height, width);
         memset(&fc->tab.cqt_depth[ch_type][x], cu->cqt_depth, width);
-- 
2.52.0.windows.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org