eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-12-11 17:30:00 +01:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/vvc/ctu: Check palette_escape_val

Browse Source 
Fixes: integer overflow
Fixes: 418314174/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-4871731867353088

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2025-06-20 01:37:23 +02:00
parent 38ead08815
commit 9d1e4feece
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/vvc/ctu.c
View File

@@ -2053,6 +2053,8 @@ static int palette_subblock_data(VVCLocalContext *lc,
const int v = PALETTE_INDEX(xc, yc); const int v = PALETTE_INDEX(xc, yc);
if (v == esc) { if (v == esc) {
const int coeff = ff_vvc_palette_escape_val(lc); const int coeff = ff_vvc_palette_escape_val(lc);
if (coeff >= (1U << sps->bit_depth))
return AVERROR_INVALIDDATA;
const int pixel = av_clip_intp2(RSHIFT(coeff * scale, 6), sps->bit_depth); const int pixel = av_clip_intp2(RSHIFT(coeff * scale, 6), sps->bit_depth);
PALETTE_SET_PIXEL(xc, yc, pixel); PALETTE_SET_PIXEL(xc, yc, pixel);
} else { } else {