[FFmpeg-devel] [PATCH] avcodec/cbs_h266_syntax_template: fix out of bounds access (PR #20139)

[Kacper Michajłow]

PR #20139 opened by Kacper Michajłow (kasper93)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20139
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20139.patch

current->num_tile_columns is not updated in the loop, so the existing
check was not working. Check current index instead and break. This also
simplifies duplicated log.

Fixes: OSS-Fuzz/435225531


From ebf4e9dd03f62e14ca1af17f6ff3ac6d77ddc96a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93 at gmail.com>
Date: Wed, 6 Aug 2025 18:26:42 +0200
Subject: [PATCH] avcodec/cbs_h266_syntax_template: fix out of bounds access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

current->num_tile_columns is not updated in the loop, so the existing
check was not working. Check current index instead and break. This also
simplifies duplicated log.

Fixes: OSS-Fuzz/435225531

Signed-off-by: Kacper Michajłow <kasper93 at gmail.com>
---
 libavcodec/cbs_h266_syntax_template.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c
index e2cc461bff..de80daaf0b 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -1897,12 +1897,8 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
         }
         unified_size = current->pps_tile_column_width_minus1[i - 1] + 1;
         while (remaining_size > 0) {
-            if (current->num_tile_columns > VVC_MAX_TILE_COLUMNS) {
-                av_log(ctx->log_ctx, AV_LOG_ERROR,
-                       "NumTileColumns(%d) > than VVC_MAX_TILE_COLUMNS(%d)\n",
-                       current->num_tile_columns, VVC_MAX_TILE_COLUMNS);
-                return AVERROR_INVALIDDATA;
-            }
+            if (i >= VVC_MAX_TILE_COLUMNS)
+                break;
             unified_size = FFMIN(remaining_size, unified_size);
             current->col_width_val[i] = unified_size;
             remaining_size -= unified_size;
-- 
2.49.1