Use the sps from the image #366
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
(as e.g mc_chroma is using the sps to determine picture properties, like pic_width_in_luma_samples and pic_height_in_luma_samples, I *think* this is more correct. This PR is for discussion. (See strukturag#345.) It makes the failures go away, but that does not mean it's correct :) The following poc will be stop failing if (only) this patch is applied: - poc2 strukturag#336 - CVE-2022-43238 - poc4 strukturag#338 - CVE-2022-43241 - poc6-1, poc6-2 strukturag#340 - CVE-2022-43242 - poc7-1, poc7-2 strukturag#341 - CVE-2022-43239 - poc8-1 strukturag#342 - CVE-2022-43244 - poc9-3 strukturag#343 - CVE-2022-43236 - poc10-2, poc10-3 strukturag#344 - CVE-2022-43237 - poc16 strukturag#350 - poc19 strukturag#353 The following are still failing if only this patch is applied, but they stop failing if strukturag#365 is applied as well, but will still fail with ONLY strukturag#365 applied (IOW, both are needed) - poc1 strukturag#335 - CVE-2022-43240 - poc3 strukturag#337 - CVE-2022-43235 - poc5 strukturag#339 - CVE-2022-43423 - poc9-1,poc9-2, poc9-4 strukturag#343 - CVE-2022-43236 - poc14 strukturag#348 - CVE-2022-43253 - poc15 strukturag#349 - CVE-2022-43248 - poc17-1, poc17-2 strukturag#351 - poc18 strukturag#352 - CVE-2022-43245
coldtobi
pushed a commit
to coldtobi/libde265
that referenced
this pull request
Jan 13, 2023
This is an attempt to improve the mitigations from strukturag#365 and strukturag#366 and picks up an idea I described at strukturag#345: > One way would be just to look at the pointers of the SPS (fast and easy, but > may reject more than required), or investigate if the SPS used for the image > generations are "compatible". This changes do exactly this: It (very conservativly) checks if the old and new sps have identical information -- except the reference picture set, which I believe is supposed to be updated by new sps'). If they are basically identical, the old sps will be used instead of the new one, (of course, reference image set is updated from the new one) I'm using standalone operator== and helper functions to avoid changing ABI of the library; if an ABI bump would be done, of course this should go to the respective classes. I've tested the patch with several videos, they still play fine. @farindk I'd really appreciate to receive your feedback; the reason is that I want to fix the many open CVE's for the package as it is currently in Debian and other distributions… -- Cheers, tobi
coldtobi
pushed a commit
to coldtobi/libde265
that referenced
this pull request
Jan 13, 2023
This is an attempt to improve the mitigations from strukturag#365 and strukturag#366 and picks up an idea I described at strukturag#345: > One way would be just to look at the pointers of the SPS (fast and easy, but > may reject more than required), or investigate if the SPS used for the image > generations are "compatible". This changes do exactly this: It (very conservativly) checks if the old and new sps have identical information -- except the reference picture set, which I believe is supposed to be updated by new sps'). If they are basically identical, the old sps will be used instead of the new one, (of course, reference image set is updated from the new one) I'm using standalone operator== and helper functions to avoid changing ABI of the library; if an ABI bump would be done, of course this should go to the respective classes.
This was referenced Jan 21, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
(as e.g mc_chroma is using the sps to determine
picture properties, like pic_width_in_luma_samples and pic_height_in_luma_samples, I think this is
more correct.
This PR is for discussion. (See #345.)
It makes the failures go away, but that does not mean it's correct :)
The following poc will be stop failing if (only) this patch is applied:
The following are still failing if only this patch is applied, but they stop failing if #365 is applied as well, but will still fail with ONLY #365 applied (IOW, both are needed)
poc1 Heap-buffer-overflow in sse-motion.cc: ff_hevc_put_hevc_qpel_h_2_v_1_sse #335 - CVE-2022-43240
poc3 Heap-buffer-overflow in sse-motion.cc: ff_hevc_put_hevc_epel_pixels_8_sse #337 - CVE-2022-43235
poc5 Heap-buffer-overflow in sse-motion.cc: ff_hevc_put_weighted_pred_avg_8_sse #339 - CVE-2022-43243
poc9-1,poc9-2, poc9-4 Stack-buffer-overflow in fallback-motion.cc: void put_qpel_fallback<unsigned short> #343 - CVE-2022-43236
poc14 Heap-buffer-overflow in fallback-motion.cc: put_unweighted_pred_16_fallback #348 - CVE-2022-43253
poc15 Heap-buffer-overflow in fallback-motion.cc: put_weighted_pred_avg_16_fallback #349 - CVE-2022-43248
poc17-1, poc17-2 Heap-buffer-overflow in sao.cc: void apply_sao_internal<unsigned short> #351poc18 SEGV sao.cc: in void apply_sao_internal<unsigned short> #352 - CVE-2022-43245Edit: poc17-x and poc-18 is NOT fixed with that. Sorry for the confusion.