FaSTTUBe/GST-Tensordecoder-ov_ep
61
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

h265parser: Fix max_dec_pic_buffering_minus1 bound check

Browse Source 
Allowed max value is MaxDpbSize - 1

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8884>
This commit is contained in:
Seungha Yang 2025-03-15 22:39:44 +09:00 committed by GStreamer Marge Bot
parent bdf22740fe
commit b33ba2f264
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gsth265parser.c
View File

@ -70,6 +70,8 @@
#include <gst/base/gstbytereader.h> #include <gst/base/gstbytereader.h>
#include <gst/base/gstbitreader.h> #include <gst/base/gstbitreader.h>
#define MAX_DPB_SIZE 16
#ifndef GST_DISABLE_GST_DEBUG #ifndef GST_DISABLE_GST_DEBUG
#define GST_CAT_DEFAULT gst_h265_debug_category_get() #define GST_CAT_DEFAULT gst_h265_debug_category_get()
static GstDebugCategory * static GstDebugCategory *
@ -1894,7 +1896,7 @@ gst_h265_parse_vps (GstH265NalUnit * nalu, GstH265VPS * vps)
for (i = for (i =
(vps->sub_layer_ordering_info_present_flag ? 0 : (vps->sub_layer_ordering_info_present_flag ? 0 :
vps->max_sub_layers_minus1); i <= vps->max_sub_layers_minus1; i++) { vps->max_sub_layers_minus1); i <= vps->max_sub_layers_minus1; i++) {
READ_UE_MAX (&nr, vps->max_dec_pic_buffering_minus1[i], G_MAXUINT32 - 1); READ_UE_MAX (&nr, vps->max_dec_pic_buffering_minus1[i], MAX_DPB_SIZE - 1);
READ_UE_MAX (&nr, vps->max_num_reorder_pics[i], READ_UE_MAX (&nr, vps->max_num_reorder_pics[i],
vps->max_dec_pic_buffering_minus1[i]); vps->max_dec_pic_buffering_minus1[i]);
READ_UE_MAX (&nr, vps->max_latency_increase_plus1[i], G_MAXUINT32 - 1); READ_UE_MAX (&nr, vps->max_latency_increase_plus1[i], G_MAXUINT32 - 1);
@ -2081,7 +2083,7 @@ gst_h265_parse_sps (GstH265Parser * parser, GstH265NalUnit * nalu,
for (i = for (i =
(sps->sub_layer_ordering_info_present_flag ? 0 : (sps->sub_layer_ordering_info_present_flag ? 0 :
sps->max_sub_layers_minus1); i <= sps->max_sub_layers_minus1; i++) { sps->max_sub_layers_minus1); i <= sps->max_sub_layers_minus1; i++) {
READ_UE_MAX (&nr, sps->max_dec_pic_buffering_minus1[i], 16); READ_UE_MAX (&nr, sps->max_dec_pic_buffering_minus1[i], MAX_DPB_SIZE - 1);
READ_UE_MAX (&nr, sps->max_num_reorder_pics[i], READ_UE_MAX (&nr, sps->max_num_reorder_pics[i],
sps->max_dec_pic_buffering_minus1[i]); sps->max_dec_pic_buffering_minus1[i]);
READ_UE_MAX (&nr, sps->max_latency_increase_plus1[i], G_MAXUINT32 - 1); READ_UE_MAX (&nr, sps->max_latency_increase_plus1[i], G_MAXUINT32 - 1);