[FFmpeg-cvslog] lavc/vvc: Reallocate pixel buffers if pixel shift changes

[Frank Plowman]

ffmpeg | branch: master | Frank Plowman <post at frankplowman.com> | Mon Jun  3 14:06:35 2024 +0100| [d866f49791c11f730ce3d277b16524220ca74f6d] | committer: Nuo Mi

lavc/vvc: Reallocate pixel buffers if pixel shift changes

Allocations in the following lines depend on the pixel shift, and so
these buffers must be reallocated if the pixel shift changes.  Patch
fixes segmentation faults in fuzzed bitstreams.

Signed-off-by: Frank Plowman <post at frankplowman.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d866f49791c11f730ce3d277b16524220ca74f6d
---

 libavcodec/vvc/dec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavcodec/vvc/dec.c b/libavcodec/vvc/dec.c
index e53ad4e607..f5603306f3 100644
--- a/libavcodec/vvc/dec.c
+++ b/libavcodec/vvc/dec.c
@@ -214,7 +214,8 @@ static void pixel_buffer_nz_tl_init(TabList *l, VVCFrameContext *fc)
     const int c_end      = chroma_idc ? VVC_MAX_SAMPLE_ARRAYS : 1;
     const int changed    = fc->tab.sz.chroma_format_idc != chroma_idc ||
         fc->tab.sz.width != width || fc->tab.sz.height != height ||
-        fc->tab.sz.ctu_width != ctu_width || fc->tab.sz.ctu_height != ctu_height;
+        fc->tab.sz.ctu_width != ctu_width || fc->tab.sz.ctu_height != ctu_height ||
+        fc->tab.sz.pixel_shift != ps;
 
     tl_init(l, 0, changed);