diff options
| author | Frank Plowman <post@frankplowman.com> | 2024-02-05 18:00:05 +0000 |
|---|---|---|
| committer | Nuo Mi <nuomi2021@gmail.com> | 2024-02-06 19:45:43 +0800 |
| commit | a42f884cd2fafb7aa53bf7b56c20355cd61ca1f5 (patch) | |
| tree | 0cebe3e5c5d9c23dc6039b31cbd338bb1b3cf9b3 | |
| parent | aa1a194a7e9ecb5b4367b60b2a73759ff7a52316 (diff) | |
lavc/vvc: Fix slice_idx out-of-bounds memset
If the number of CTUs reduces between one picture and the next, the
slice_idx table is reduced in size in the frame_context_for_each_tl call
on vvcdec.c:321. When initialising the slice_idx table on vvcdec.c:325,
the old code uses fc->tab.sz.ctu_count when calculating the table size.
fc->tab.sz.ctu_count holds the old ctu count at this point however, not
being updated to hold the new ctu count until vvcdec.c:342. This causes
an out-of-bounds write.
Patch fixes the problem by using pps->ctb_count, which was just used
when allocating the table, in place of fc->tab.sz.ctu_count when
initialising the table.
Signed-off-by: Frank Plowman <post@frankplowman.com>
| -rw-r--r-- | libavcodec/vvc/vvcdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/vvc/vvcdec.c b/libavcodec/vvc/vvcdec.c index 1a050600eb..8163b5ecb6 100644 --- a/libavcodec/vvc/vvcdec.c +++ b/libavcodec/vvc/vvcdec.c @@ -322,7 +322,7 @@ static int pic_arrays_init(VVCContext *s, VVCFrameContext *fc) if (ret < 0) return ret; - memset(fc->tab.slice_idx, -1, sizeof(*fc->tab.slice_idx) * fc->tab.sz.ctu_count); + memset(fc->tab.slice_idx, -1, sizeof(*fc->tab.slice_idx) * ctu_count); if (fc->tab.sz.ctu_count != ctu_count) { ff_refstruct_pool_uninit(&fc->rpl_tab_pool); |