The size variable here is taken as gospel for the bounds of the input
buffer in later logic.  Clamp it to ensure that the returned region
does not extend past that allocated in the underlying GetBitContext,
even in the case entry point offsets are signalled in the bitstream.
Also assert this for good measure.

Signed-off-by: Frank Plowman <[email protected]>
---
 libavcodec/vvc/dec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/vvc/dec.c b/libavcodec/vvc/dec.c
index 27ffbb741d..a4fc40b40a 100644
--- a/libavcodec/vvc/dec.c
+++ b/libavcodec/vvc/dec.c
@@ -497,9 +497,11 @@ static void ep_init_cabac_decoder(SliceContext *sc, const 
int index,
             skipped++;
         }
         size = end - start;
+        size = av_clip(size, 0, get_bits_left(gb) / 8);
     } else {
         size = get_bits_left(gb) / 8;
     }
+    av_assert0(gb->buffer + get_bits_count(gb) / 8 + size <= gb->buffer_end);
     ff_init_cabac_decoder (&ep->cc, gb->buffer + get_bits_count(gb) / 8, size);
     skip_bits(gb, size * 8);
 }
-- 
2.44.0

_______________________________________________
ffmpeg-devel mailing list
[email protected]
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
[email protected] with subject "unsubscribe".

Reply via email to