mirrors/gstreamer
mirrors/gstreamer
1
1
Fork 0
mirror of https://gitlab.freedesktop.org/gstreamer/gstreamer.git synced 2025-01-31 03:29:50 +00:00
Code Issues 1 Projects Releases Wiki Activity

codecparsers: av1: Clip max tile rows and cols values

Browse source 
Clip tile rows and cols to 64 as describe in AV1 specification
to avoid writing outside array range but preserve sb_cols
and sb_rows value which are used to futher computation.

Fixes ZDI-CAN-22226 / CVE-2023-44429

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5702>
This commit is contained in:
Benjamin Gaignard 2023-11-21 14:26:54 +01:00 committed by GStreamer Marge Bot
parent f525de6d00
commit cd14b0892e
1 changed files with 10 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c
View file

@ -2260,7 +2260,9 @@ gst_av1_parse_tile_info (GstAV1Parser * parser, GstBitReader * br,
tile_width_sb = (sb_cols + (1 << parser->state.tile_cols_log2) - tile_width_sb = (sb_cols + (1 << parser->state.tile_cols_log2) -
1) >> parser->state.tile_cols_log2; 1) >> parser->state.tile_cols_log2;
i = 0; i = 0;
for (start_sb = 0; start_sb < sb_cols; start_sb += tile_width_sb) { /* Fill mi_col_starts[] and make sure to not exceed array range */
for (start_sb = 0; start_sb < sb_cols && i < GST_AV1_MAX_TILE_COLS;
start_sb += tile_width_sb) {
parser->state.mi_col_starts[i] = start_sb << sb_shift; parser->state.mi_col_starts[i] = start_sb << sb_shift;
i += 1; i += 1;
} }
@ -2289,7 +2291,9 @@ gst_av1_parse_tile_info (GstAV1Parser * parser, GstBitReader * br,
tile_height_sb = (sb_rows + (1 << parser->state.tile_rows_log2) - tile_height_sb = (sb_rows + (1 << parser->state.tile_rows_log2) -
1) >> parser->state.tile_rows_log2; 1) >> parser->state.tile_rows_log2;
i = 0; i = 0;
for (start_sb = 0; start_sb < sb_rows; start_sb += tile_height_sb) { /* Fill mi_row_starts[] and make sure to not exceed array range */
for (start_sb = 0; start_sb < sb_rows && i < GST_AV1_MAX_TILE_ROWS;
start_sb += tile_height_sb) {
parser->state.mi_row_starts[i] = start_sb << sb_shift; parser->state.mi_row_starts[i] = start_sb << sb_shift;
i += 1; i += 1;
} }
@ -2304,7 +2308,8 @@ gst_av1_parse_tile_info (GstAV1Parser * parser, GstBitReader * br,
} else { } else {
widest_tile_sb = 0; widest_tile_sb = 0;
start_sb = 0; start_sb = 0;
for (i = 0; start_sb < sb_cols; i++) { /* Fill mi_col_starts[] and make sure to not exceed array range */
for (i = 0; start_sb < sb_cols && i < GST_AV1_MAX_TILE_COLS; i++) {
parser->state.mi_col_starts[i] = start_sb << sb_shift; parser->state.mi_col_starts[i] = start_sb << sb_shift;
max_width = MIN (sb_cols - start_sb, max_tile_width_sb); max_width = MIN (sb_cols - start_sb, max_tile_width_sb);
tile_info->width_in_sbs_minus_1[i] = tile_info->width_in_sbs_minus_1[i] =
@ -2329,7 +2334,8 @@ gst_av1_parse_tile_info (GstAV1Parser * parser, GstBitReader * br,
max_tile_height_sb = MAX (max_tile_area_sb / widest_tile_sb, 1); max_tile_height_sb = MAX (max_tile_area_sb / widest_tile_sb, 1);
start_sb = 0; start_sb = 0;
for (i = 0; start_sb < sb_rows; i++) { /* Fill mi_row_starts[] and make sure to not exceed array range */
for (i = 0; start_sb < sb_rows && i < GST_AV1_MAX_TILE_ROWS; i++) {
parser->state.mi_row_starts[i] = start_sb << sb_shift; parser->state.mi_row_starts[i] = start_sb << sb_shift;
max_height = MIN (sb_rows - start_sb, max_tile_height_sb); max_height = MIN (sb_rows - start_sb, max_tile_height_sb);
tile_info->height_in_sbs_minus_1[i] = tile_info->height_in_sbs_minus_1[i] =