From d0d2cf549bad34a6e2f9a40a80784450b51168be Mon Sep 17 00:00:00 2001 From: Hyunjun Ko Date: Wed, 31 Jan 2024 09:20:31 +0900 Subject: [PATCH] anv/video: fix out-of-bounds read Since STD_VIDEO_H265_CHROMA_QP_OFFSET_TILE_COLS_LIST_SIZE is 19. Fixes: 8d519eb5 ("anv: add initial video decode support for h265") Closes: mesa/mesa#10529 Signed-off-by: Hyunjun Ko Acked-by: Lionel Landwerlin Part-of: --- src/intel/vulkan/genX_cmd_video.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/intel/vulkan/genX_cmd_video.c b/src/intel/vulkan/genX_cmd_video.c index 52994173d9d..8eacbf12eef 100644 --- a/src/intel/vulkan/genX_cmd_video.c +++ b/src/intel/vulkan/genX_cmd_video.c @@ -551,7 +551,8 @@ anv_h265_decode_video(struct anv_cmd_buffer *cmd_buffer, cum += pps->column_width_minus1[4 * i + 2] + 1; tile.ColumnPosition[i].CtbPos3i = cum; - if ((4 * i + 3) == pps->num_tile_columns_minus1) + if ((4 * i + 3) >= MIN2(pps->num_tile_columns_minus1, + ARRAY_SIZE(pps->column_width_minus1))) break; cum += pps->column_width_minus1[4 * i + 3] + 1;