Files
FFmpeg/libavutil
luoye-cpu 182bb23bf8 avutil/hdr_dynamic_metadata: reject oversized HDR10+ counts
av_dynamic_hdr_plus_to_t35() uses caller-supplied counts as loop
bounds over fixed-size arrays. A count slightly above an array
length can make the write loop read out of bounds while the
payload remains well within AV_HDR_PLUS_MAX_PAYLOAD_SIZE.

Reject counts above the array bounds with AVERROR(EINVAL), since
these are caller-supplied fields rather than data parsed off the
wire. The checks are gated like the reads they guard: the
targeted-system-display and mastering-display peak-luminance
counts and the bezier anchors are only read when their respective
flags are set. Rejecting oversized counts also keeps the payload
within AV_HDR_PLUS_MAX_PAYLOAD_SIZE, but the size assertion is not
a substitute for validating the array bounds.

FATE cases cover every rejected count and, for gated counts,
out-of-range values with their flags clear, which must still
serialize.

Signed-off-by: luoye-cpu <3412829159@qq.com>
2026-11-04 19:36:53 +00:00
..
2026-09-30 17:16:00 +00:00
2025-08-03 13:48:47 +02:00
…
2026-04-28 12:29:37 +00:00
2026-06-23 19:15:57 +02:00
…
2026-09-07 03:57:59 +00:00
2024-03-04 17:45:00 +01:00
…
…
2025-08-03 13:48:47 +02:00
2026-09-12 23:52:20 +00:00
2023-11-18 19:55:42 +01:00
2026-09-12 23:52:20 +00:00
2024-03-15 12:51:15 +01:00
…
…
2026-01-18 03:33:04 +00:00
2026-09-12 23:52:20 +00:00
…
…
2025-08-03 13:48:47 +02:00
2024-06-01 18:05:58 +03:00
2025-08-03 13:48:47 +02:00
…
…
2023-09-07 00:42:10 +02:00
…
2023-09-07 00:42:10 +02:00
…
2024-03-31 00:08:43 +01:00
…
2026-10-06 13:31:37 +09:00
2025-09-02 17:05:50 +02:00
2026-10-31 14:22:46 +00:00
2026-10-06 13:31:37 +09:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
…
…
…
2024-01-16 01:34:57 +01:00
…
…
2025-08-03 13:48:47 +02:00
…
…
2026-09-30 17:16:00 +00:00
…
…
2022-10-17 09:51:47 +02:00
2023-09-07 00:42:10 +02:00
2025-08-03 13:48:47 +02:00
2026-06-23 19:15:57 +02:00
2023-08-08 09:46:11 +02:00
2025-08-03 13:48:47 +02:00
…