From: Benjamin Gaignard Date: Wed, 4 Oct 2023 11:14:38 +0200 Subject: codecparsers: av1: Clip max tile rows and cols values Origin: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/b76a801f57353b893c344025cac56413140fca6d Bug-Debian: https://bugs.debian.org/1056102 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2023-44429 Clip tile rows and cols to 64 as describe in AV1 specification. Fixes ZDI-CAN-22226 / CVE-2023-44429 Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3015 Part-of: --- .../gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c | 2 ++ 1 file changed, 2 insertions(+) --- a/gst-libs/gst/codecparsers/gstav1parser.c +++ b/gst-libs/gst/codecparsers/gstav1parser.c @@ -2211,6 +2211,8 @@ gst_av1_parse_tile_info (GstAV1Parser * ((parser->state.mi_cols + 31) >> 5) : ((parser->state.mi_cols + 15) >> 4); sb_rows = seq_header->use_128x128_superblock ? ((parser->state.mi_rows + 31) >> 5) : ((parser->state.mi_rows + 15) >> 4); + sb_cols = MIN (GST_AV1_MAX_TILE_COLS, sb_cols); + sb_rows = MIN (GST_AV1_MAX_TILE_ROWS, sb_rows); sb_shift = seq_header->use_128x128_superblock ? 5 : 4; sb_size = sb_shift + 2; max_tile_width_sb = GST_AV1_MAX_TILE_WIDTH >> sb_size;