[FFmpeg-cvslog] avcodec/vvc/vvc_ps: Check before access

[Andreas Rheinhardt]

ffmpeg | branch: master | Andreas Rheinhardt <andreas.rheinhardt at outlook.com> | Sun Feb 18 18:52:25 2024 +0100| [1eafbc27e2d3824b2fd3123bd78c25bc60fed8ba] | committer: Andreas Rheinhardt

avcodec/vvc/vvc_ps: Check before access

max_bin_idx can be at most LMCS_MAX_BIN_SIZE - 1 here,
so pivot[LCMS_MAX_BIN_SIZE + 1] may be accessed,
but pivot has only LCMS_MAX_BIN_SIZE + 1 elements
(unless the values of pivot were so that it is always
assured that pivot[LCMS_MAX_BIN_SIZE] is always < sample
(which it is iff it is always < 2^bit_depth - 1)).
So reorder the checks.

Reviewed-by: Nuo Mi <nuomi2021 at gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt at outlook.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1eafbc27e2d3824b2fd3123bd78c25bc60fed8ba
---

 libavcodec/vvc/vvc_ps.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/vvc/vvc_ps.c b/libavcodec/vvc/vvc_ps.c
index 53a86321d6..376027ed81 100644
--- a/libavcodec/vvc/vvc_ps.c
+++ b/libavcodec/vvc/vvc_ps.c
@@ -652,7 +652,7 @@ static int lmcs_derive_lut(VVCLMCS *lmcs, const H266RawAPS *rlmcs, const H266Raw
     i = lmcs->min_bin_idx;
     for (uint16_t sample = 0; sample < max; sample++) {
         uint16_t inv_sample;
-        while (sample >= lmcs->pivot[i + 1] && i <= lmcs->max_bin_idx)
+        while (i <= lmcs->max_bin_idx && sample >= lmcs->pivot[i + 1])
             i++;
 
         inv_sample = lmcs_derive_lut_sample(sample, input_pivot, lmcs->pivot,