"The value of CurrentPaletteSize[ startComp ] shall be in the range of 0
to maxNumPaletteEntries, inclusive."
Signed-off-by: Frank Plowman <p...@frankplowman.com>
---
libavcodec/vvc/ctu.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c
index 62c9d4f5c0..70800ba5fa 100644
--- a/libavcodec/vvc/ctu.c
+++ b/libavcodec/vvc/ctu.c
@@ -20,6 +20,7 @@
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
+#include "libavutil/error.h"
#include "libavutil/refstruct.h"
#include "cabac.h"
@@ -1873,7 +1874,7 @@ static void palette_predicted(VVCLocalContext *lc, const
bool local_dual_tree, i
cu->plt[c].size = nb_predicted;
}
-static void palette_signaled(VVCLocalContext *lc, const bool local_dual_tree,
+static int palette_signaled(VVCLocalContext *lc, const bool local_dual_tree,
const int start, const int end, const int max_entries)
{
const VVCSPS *sps = lc->fc->ps.sps;
@@ -1883,6 +1884,9 @@ static void palette_signaled(VVCLocalContext *lc, const
bool local_dual_tree,
const int size = nb_predicted + nb_signaled;
const bool dual_tree_luma = local_dual_tree && cu->tree_type ==
DUAL_TREE_LUMA;
+ if (size > max_entries)
+ return AVERROR_INVALIDDATA;
+
for (int c = start; c < end; c++) {
Palette *plt = cu->plt + c;
for (int i = nb_predicted; i < size; i++) {
@@ -1894,6 +1898,8 @@ static void palette_signaled(VVCLocalContext *lc, const
bool local_dual_tree,
}
plt->size = size;
}
+
+ return 0;
}
static void palette_update_predictor(VVCLocalContext *lc, const bool
local_dual_tree, int start, int end,
@@ -2070,7 +2076,7 @@ static int hls_palette_coding(VVCLocalContext *lc, const
VVCTreeType tree_type)
int max_index = 0;
int prev_run_pos = 0;
- int predictor_size, start, end;
+ int predictor_size, start, end, ret;
bool reused[VVC_MAX_NUM_PALETTE_PREDICTOR_SIZE];
uint8_t run_type[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE];
uint8_t index[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE];
@@ -2083,7 +2089,9 @@ static int hls_palette_coding(VVCLocalContext *lc, const
VVCTreeType tree_type)
predictor_size = pp[start].size;
memset(reused, 0, sizeof(reused[0]) * predictor_size);
palette_predicted(lc, local_dual_tree, start, end, reused, predictor_size,
max_entries);
- palette_signaled(lc, local_dual_tree, start, end, max_entries);
+ ret = palette_signaled(lc, local_dual_tree, start, end, max_entries);
+ if (ret < 0)
+ return ret;
palette_update_predictor(lc, local_dual_tree, start, end, reused,
predictor_size);
if (cu->plt[start].size > 0)
--
2.47.0
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
