avcodec/vulkan/ffv1_dec_setup: reject a remap that produces zero entries

This commit is contained in:
Michael Niedermayer
2026-07-30 01:41:06 +02:00
committed by michaelni
parent 533a3c254d
commit cc82fdfbd4

View File

@@ -91,7 +91,7 @@ int decode_current_mul(uint ctx_off, int mul_count, int64_t i)
return mul[ndx];
}
void decode_remap(uint slice_idx, inout SliceContext sc)
bool decode_remap(uint slice_idx, inout SliceContext sc)
{
uint end = uint(rct_offset - 1);
uint flip_mask = end ^ (end >> 1);
@@ -106,10 +106,8 @@ void decode_remap(uint slice_idx, inout SliceContext sc)
rc_state[k] = uint8_t(128);
int mul_count = int(get_usymbol(0));
if (mul_count > 4096) {
sc.remap_count[p] = j;
return;
}
if (mul_count > 4096)
return true;
for (int mi = 0; mi < mul_count; mi++)
mul[mi] = -1;
mul[mul_count] = 1;
@@ -131,10 +129,8 @@ void decode_remap(uint slice_idx, inout SliceContext sc)
run1--;
if (current_mul > 1) {
int delta = get_isymbol(uint(lu*3 + 1)*CONTEXT_SIZE);
if (delta <= -current_mul || delta > current_mul/2) {
sc.remap_count[p] = j;
return;
}
if (delta <= -current_mul || delta > current_mul/2)
return true;
i += int64_t(current_mul - 1 + delta);
}
if (i - 1 >= int64_t(end))
@@ -148,8 +144,12 @@ void decode_remap(uint slice_idx, inout SliceContext sc)
i += int64_t(current_mul);
lu ^= int(run == 0u);
}
if (j == 0)
return true;
sc.remap_count[p] = j;
}
return false;
}
bool decode_slice_header(uint slice_idx, inout SliceContext sc)
@@ -200,8 +200,8 @@ bool decode_slice_header(uint slice_idx, inout SliceContext sc)
if (micro_version >= 4) {
sc.remap = get_usymbol(0);
if (sc.remap != 0)
decode_remap(slice_idx, sc);
if (sc.remap != 0 && decode_remap(slice_idx, sc))
return true;
}
}