[FFmpeg-devel] [PATCH 2/2] avcodec/cbs_h265_syntax_template: Limit sps_num_palette_predictor_initializer_minus1 to 127

[Michael Niedermayer]

On Mon, Sep 20, 2021 at 09:57:02AM -0300, James Almer wrote:
> On 9/19/2021 5:35 PM, Michael Niedermayer wrote:
> > Fixes: index 128 out of bounds for type 'uint16_t [128]'
> > Fixes: 38651/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-6296416058736640
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >   libavcodec/cbs_h265_syntax_template.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavcodec/cbs_h265_syntax_template.c b/libavcodec/cbs_h265_syntax_template.c
> > index 67bc77f9751..fb8ac4a4a77 100644
> > --- a/libavcodec/cbs_h265_syntax_template.c
> > +++ b/libavcodec/cbs_h265_syntax_template.c
> > @@ -728,7 +728,7 @@ static int FUNC(sps_scc_extension)(CodedBitstreamContext *ctx, RWContext *rw,
> >           flag(sps_palette_predictor_initializer_present_flag);
> >           if (current->sps_palette_predictor_initializer_present_flag) {
> > -            ue(sps_num_palette_predictor_initializer_minus1, 0, 128);
> > +            ue(sps_num_palette_predictor_initializer_minus1, 0, 127);
> >               for (comp = 0; comp < (current->chroma_format_idc ? 3 : 1); comp++) {
> >                   int bit_depth = comp == 0 ? current->bit_depth_luma_minus8 + 8
> >                                             : current->bit_depth_chroma_minus8 + 8;
> > 
> 
> sps_num_palette_predictor_initializer_minus1 plus 1 must be at most 128, so
> LGTM.

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

No snowflake in an avalanche ever feels responsible. -- Voltaire
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20210920/89bc249b/attachment.sig>