mirrors/gstreamer
mirrors/gstreamer
1
1
Fork 0
mirror of https://gitlab.freedesktop.org/gstreamer/gstreamer.git synced 2025-02-02 12:32:29 +00:00
Code Issues 1 Projects Releases Wiki Activity

nvh265sldec: Fix possible invalid memory access

Browse source 
Fix Coverity issues.

CID 1464959, 1464960, 1464961, 1464962

Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/merge_requests/1374>
This commit is contained in:
Seungha Yang 2020-06-25 19:26:45 +09:00 committed by GStreamer Merge Bot
parent 290d0432c3
commit 48ca7c7e93
1 changed files with 33 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
sys/nvcodec/gstnvh265dec.c
View file

@ -602,10 +602,16 @@ gst_nv_h265_dec_picture_params_from_pps (GstNvH265Dec * self,
COPY_FIELD_WITH_PREFIX (tc_offset_div2);
COPY_FIELD (tiles_enabled_flag);
COPY_FIELD (uniform_spacing_flag);
if (pps->tiles_enabled_flag) {
guint num_tile_columns;
guint num_tile_rows;
COPY_FIELD (num_tile_columns_minus1);
COPY_FIELD (num_tile_rows_minus1);
if (pps->num_tile_columns_minus1 > G_N_ELEMENTS (params->column_width_minus1)) {
if (pps->num_tile_columns_minus1 >
G_N_ELEMENTS (params->column_width_minus1)) {
GST_ERROR_OBJECT (self,
"Too large column_width_minus1 %d", pps->num_tile_columns_minus1);
return FALSE;
@ -617,11 +623,20 @@ gst_nv_h265_dec_picture_params_from_pps (GstNvH265Dec * self,
return FALSE;
}
for (i = 0; i < pps->num_tile_columns_minus1 + 1; i++)
/* XXX: The size of column_width_minus1 array in CUVIDHEVCPICPARAMS struct
* is 21 which is inconsistent with the spec.
* Just copy values as many as possible */
num_tile_columns = MIN (pps->num_tile_columns_minus1,
G_N_ELEMENTS (pps->column_width_minus1));
num_tile_rows = MIN (pps->num_tile_rows_minus1,
G_N_ELEMENTS (pps->row_height_minus1));
for (i = 0; i < num_tile_columns; i++)
COPY_FIELD (column_width_minus1[i]);
for (i = 0; i < pps->num_tile_rows_minus1 + 1; i++)
for (i = 0; i < num_tile_rows; i++)
COPY_FIELD (row_height_minus1[i]);
}
COPY_FIELD (pps_range_extension_flag);
if (pps->pps_range_extension_flag) {