On 9/19/2021 5:35 PM, Michael Niedermayer wrote:
Fixes: index 128 out of bounds for type 'uint16_t [128]'
Fixes:
38651/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-6296416058736640
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
libavcodec/cbs_h265_syntax_template.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/cbs_h265_syntax_template.c
b/libavcodec/cbs_h265_syntax_template.c
index 67bc77f9751..fb8ac4a4a77 100644
--- a/libavcodec/cbs_h265_syntax_template.c
+++ b/libavcodec/cbs_h265_syntax_template.c
@@ -728,7 +728,7 @@ static int FUNC(sps_scc_extension)(CodedBitstreamContext
*ctx, RWContext *rw,
flag(sps_palette_predictor_initializer_present_flag);
if (current->sps_palette_predictor_initializer_present_flag) {
- ue(sps_num_palette_predictor_initializer_minus1, 0, 128);
+ ue(sps_num_palette_predictor_initializer_minus1, 0, 127);
for (comp = 0; comp < (current->chroma_format_idc ? 3 : 1);
comp++) {
int bit_depth = comp == 0 ? current->bit_depth_luma_minus8 + 8
: current->bit_depth_chroma_minus8
+ 8;
sps_num_palette_predictor_initializer_minus1 plus 1 must be at most 128,
so LGTM.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
