On Wed May 27 15:47:37 2026 -0400, Michael Bommarito wrote:
> st_ref_pic_set_prediction() computes the reference RPS index as
> st_rps_idx - (delta_idx_minus1 + 1) per HEVC spec equation 7-59.
> Both operands are u8, so when delta_idx_minus1 + 1 exceeds the
> current index the subtraction wraps and the subsequent array access
> at calculated_rps_st_sets[ref_rps_idx] reads far out of bounds.
>
> A userspace V4L2 client that can open the RKVDEC m2m decoder can
> submit an EXT_SPS_ST_RPS control with INTER_REF_PIC_SET_PRED set
> and delta_idx_minus1 crafted to trigger the underflow.
>
> Reject the entry early when the reference index would underflow.
>
> Fixes: c9a59dc2acc7 ("media: rkvdec: Add HEVC support for the VDPU381
> variant")
> Cc: [email protected]
> Suggested-by: Detlev Casanova <[email protected]>
> Assisted-by: Claude:claude-opus-4-7
> Signed-off-by: Michael Bommarito <[email protected]>
> Reviewed-by: Nicolas Dufresne <[email protected]>
> Signed-off-by: Nicolas Dufresne <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c | 3 +++
1 file changed, 3 insertions(+)
---
diff --git a/drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c
b/drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c
index f89602075121..9c4a6093af32 100644
--- a/drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c
+++ b/drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c
@@ -209,6 +209,9 @@ static void st_ref_pic_set_prediction(struct
rkvdec_hevc_run *run, int idx,
int i, j;
int dPoc;
+ if ((unsigned int)rps_data->delta_idx_minus1 + 1 > idx)
+ return;
+
ref_rps_idx = st_rps_idx - (rps_data->delta_idx_minus1 + 1); /* 7-59 */
delta_rps = (1 - 2 * rps_data->delta_rps_sign) *
(rps_data->abs_delta_rps_minus1 + 1); /* 7-60 */
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
