OpenHarmony/third_party_mesa3d
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

anv/video: fix out-of-bounds read

Browse Source 
Since STD_VIDEO_H265_CHROMA_QP_OFFSET_TILE_COLS_LIST_SIZE is 19.

Fixes: 8d519eb5 ("anv: add initial video decode support for h265")
Closes: mesa/mesa#10529

Signed-off-by: Hyunjun Ko <zzoon@igalia.com>
Acked-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27373>
(cherry picked from commit d0d2cf549b)
This commit is contained in:
Hyunjun Ko
2024-01-31 09:20:31 +09:00
committed by Eric Engestrom
parent 7c3d9a3fa4
commit d21f8ce64f
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.pick_status.json
View File

@@ -414,7 +414,7 @@
"description": "anv/video: fix out-of-bounds read",
"nominated": true,
"nomination_type": 1,
"resolution": 0,
"resolution": 1,
"main_sha": null,
"because_sha": "8d519eb5f5947800279e4c02bf7aa79b0b65cd17",
"notes": null

3
src/intel/vulkan/genX_video.c
View File

@@ -551,7 +551,8 @@ anv_h265_decode_video(struct anv_cmd_buffer *cmd_buffer,
cum += pps->column_width_minus1[4 * i + 2] + 1;
tile.ColumnPosition[i].CtbPos3i = cum;
if ((4 * i + 3) == pps->num_tile_columns_minus1)
if ((4 * i + 3) >= MIN2(pps->num_tile_columns_minus1,
ARRAY_SIZE(pps->column_width_minus1)))
break;
cum += pps->column_width_minus1[4 * i + 3] + 1;