66 lines
3.1 KiB
Diff
66 lines
3.1 KiB
Diff
From 73f1409447033b8e3291a51893d5a027e2be15fc Mon Sep 17 00:00:00 2001
|
|
From: Benjamin Gaignard <benjamin.gaignard@collabora.com>
|
|
Date: Tue, 21 Nov 2023 14:26:54 +0100
|
|
Subject: [PATCH 2/2] codecparsers: av1: Clip max tile rows and cols values
|
|
|
|
Clip tile rows and cols to 64 as describe in AV1 specification
|
|
to avoid writing outside array range but preserve sb_cols
|
|
and sb_rows value which are used to futher computation.
|
|
|
|
Fixes ZDI-CAN-22226 / CVE-2023-44429
|
|
|
|
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5734>
|
|
---
|
|
.../gst-libs/gst/codecparsers/gstav1parser.c | 14 ++++++++++----
|
|
1 file changed, 10 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c b/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c
|
|
index 22ffefd168..7ef583c7f5 100644
|
|
--- a/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c
|
|
+++ b/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c
|
|
@@ -2243,7 +2243,9 @@ gst_av1_parse_tile_info (GstAV1Parser * parser, GstBitReader * br,
|
|
tile_width_sb = (sb_cols + (1 << parser->state.tile_cols_log2) -
|
|
1) >> parser->state.tile_cols_log2;
|
|
i = 0;
|
|
- for (start_sb = 0; start_sb < sb_cols; start_sb += tile_width_sb) {
|
|
+ /* Fill mi_col_starts[] and make sure to not exceed array range */
|
|
+ for (start_sb = 0; start_sb < sb_cols && i < GST_AV1_MAX_TILE_COLS;
|
|
+ start_sb += tile_width_sb) {
|
|
parser->state.mi_col_starts[i] = start_sb << sb_shift;
|
|
i += 1;
|
|
}
|
|
@@ -2272,7 +2274,9 @@ gst_av1_parse_tile_info (GstAV1Parser * parser, GstBitReader * br,
|
|
tile_height_sb = (sb_rows + (1 << parser->state.tile_rows_log2) -
|
|
1) >> parser->state.tile_rows_log2;
|
|
i = 0;
|
|
- for (start_sb = 0; start_sb < sb_rows; start_sb += tile_height_sb) {
|
|
+ /* Fill mi_row_starts[] and make sure to not exceed array range */
|
|
+ for (start_sb = 0; start_sb < sb_rows && i < GST_AV1_MAX_TILE_ROWS;
|
|
+ start_sb += tile_height_sb) {
|
|
parser->state.mi_row_starts[i] = start_sb << sb_shift;
|
|
i += 1;
|
|
}
|
|
@@ -2287,7 +2291,8 @@ gst_av1_parse_tile_info (GstAV1Parser * parser, GstBitReader * br,
|
|
} else {
|
|
widest_tile_sb = 0;
|
|
start_sb = 0;
|
|
- for (i = 0; start_sb < sb_cols; i++) {
|
|
+ /* Fill mi_col_starts[] and make sure to not exceed array range */
|
|
+ for (i = 0; start_sb < sb_cols && i < GST_AV1_MAX_TILE_COLS; i++) {
|
|
parser->state.mi_col_starts[i] = start_sb << sb_shift;
|
|
max_width = MIN (sb_cols - start_sb, max_tile_width_sb);
|
|
tile_info->width_in_sbs_minus_1[i] =
|
|
@@ -2312,7 +2317,8 @@ gst_av1_parse_tile_info (GstAV1Parser * parser, GstBitReader * br,
|
|
max_tile_height_sb = MAX (max_tile_area_sb / widest_tile_sb, 1);
|
|
|
|
start_sb = 0;
|
|
- for (i = 0; start_sb < sb_rows; i++) {
|
|
+ /* Fill mi_row_starts[] and make sure to not exceed array range */
|
|
+ for (i = 0; start_sb < sb_rows && i < GST_AV1_MAX_TILE_ROWS; i++) {
|
|
parser->state.mi_row_starts[i] = start_sb << sb_shift;
|
|
max_height = MIN (sb_rows - start_sb, max_tile_height_sb);
|
|
tile_info->height_in_sbs_minus_1[i] =
|
|
--
|
|
2.43.0
|
|
|