From cd14b0892ed002ff8e6a97e513bca2903eb7f9b2 Mon Sep 17 00:00:00 2001 From: Benjamin Gaignard <benjamin.gaignard@collabora.com> Date: Tue, 21 Nov 2023 14:26:54 +0100 Subject: [PATCH] codecparsers: av1: Clip max tile rows and cols values Clip tile rows and cols to 64 as describe in AV1 specification to avoid writing outside array range but preserve sb_cols and sb_rows value which are used to futher computation. Fixes ZDI-CAN-22226 / CVE-2023-44429 Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5702> --- .../gst-libs/gst/codecparsers/gstav1parser.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c b/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c index 0b4ce34488..33335c421f 100644 --- a/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c +++ b/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c @@ -2260,7 +2260,9 @@ gst_av1_parse_tile_info (GstAV1Parser * parser, GstBitReader * br, tile_width_sb = (sb_cols + (1 << parser->state.tile_cols_log2) - 1) >> parser->state.tile_cols_log2; i = 0; - for (start_sb = 0; start_sb < sb_cols; start_sb += tile_width_sb) { + /* Fill mi_col_starts[] and make sure to not exceed array range */ + for (start_sb = 0; start_sb < sb_cols && i < GST_AV1_MAX_TILE_COLS; + start_sb += tile_width_sb) { parser->state.mi_col_starts[i] = start_sb << sb_shift; i += 1; } @@ -2289,7 +2291,9 @@ gst_av1_parse_tile_info (GstAV1Parser * parser, GstBitReader * br, tile_height_sb = (sb_rows + (1 << parser->state.tile_rows_log2) - 1) >> parser->state.tile_rows_log2; i = 0; - for (start_sb = 0; start_sb < sb_rows; start_sb += tile_height_sb) { + /* Fill mi_row_starts[] and make sure to not exceed array range */ + for (start_sb = 0; start_sb < sb_rows && i < GST_AV1_MAX_TILE_ROWS; + start_sb += tile_height_sb) { parser->state.mi_row_starts[i] = start_sb << sb_shift; i += 1; } @@ -2304,7 +2308,8 @@ gst_av1_parse_tile_info (GstAV1Parser * parser, GstBitReader * br, } else { widest_tile_sb = 0; start_sb = 0; - for (i = 0; start_sb < sb_cols; i++) { + /* Fill mi_col_starts[] and make sure to not exceed array range */ + for (i = 0; start_sb < sb_cols && i < GST_AV1_MAX_TILE_COLS; i++) { parser->state.mi_col_starts[i] = start_sb << sb_shift; max_width = MIN (sb_cols - start_sb, max_tile_width_sb); tile_info->width_in_sbs_minus_1[i] = @@ -2329,7 +2334,8 @@ gst_av1_parse_tile_info (GstAV1Parser * parser, GstBitReader * br, max_tile_height_sb = MAX (max_tile_area_sb / widest_tile_sb, 1); start_sb = 0; - for (i = 0; start_sb < sb_rows; i++) { + /* Fill mi_row_starts[] and make sure to not exceed array range */ + for (i = 0; start_sb < sb_rows && i < GST_AV1_MAX_TILE_ROWS; i++) { parser->state.mi_row_starts[i] = start_sb << sb_shift; max_height = MIN (sb_rows - start_sb, max_tile_height_sb); tile_info->height_in_sbs_minus_1[i] =