In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: rkvdec: bound HEVC tile loops and PPS id to the array capacity<\/p>\n
compute_tiles_uniform() and compute_tiles_non_uniform() loop over
\nnum_tile_columns_minus1 + 1 \/ num_tile_rows_minus1 + 1 entries, and
\nassemble_hw_pps() writes one COLUMN_WIDTH \/ ROW_HEIGHT register per tile
\nand indexes priv_tbl->param_set[] by pic_parameter_set_id, all taken from
\nthe untrusted PPS. Use the bounded v4l2_hevc_pps_num_tile_columns() \/
\nv4l2_hevc_pps_num_tile_rows() helpers for the tile loops, and bail out of
\nassemble_hw_pps() before indexing priv_tbl->param_set[] with an
\nout-of-range pic_parameter_set_id, so the writes stay within the hardware
\ntables.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: rkvdec: bound HEVC tile loops and PPS id to the array capacity<\/p>\n
compute_tiles_uniform() and compute_tiles_non_uniform() loop<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29012","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29012","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29012"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29012"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29012"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}