In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer<\/p>\n
rockchip_vpu981_av1_dec_set_tile_info() divides context_update_tile_id by
\ntile_info->tile_cols and writes one descriptor per tile into the tile_info
\nDMA buffer, which holds AV1_MAX_TILES entries; tile_cols and tile_rows
\ncome from the bitstream. Guard the division against a zero tile_cols by
\ninitialising the context-update values to zero and computing them only
\nwhen tile_cols is non-zero, and stop the descriptor writes once the
\ntile_info buffer is full. The tile geometry written to the hardware
\nregisters is left unmodified; the per-dimension and total tile bounds are
\nenforced by the control validation.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer<\/p>\n
rockchip_vpu981_av1_dec_set_tile_info() divides context_upd<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29010","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29010","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29010"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29010"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29010"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}