Re: [PATCH v2 2/3] media: v4l2-ctrls: validate HEVC EXT SPS RPS counts

[Nicolas Dufresne <nicolas.dufresne@collabora.com>]

[-- Attachment #1: Type: text/plain, Size: 3005 bytes --]

Le mercredi 27 mai 2026 à 15:47 -0400, Michael Bommarito a écrit :
> The HEVC SPS control carries the short-term and long-term RPS counts
> that decoder drivers use to walk the matching EXT SPS dynamic arrays.
> Reject SPS values that exceed the HEVC limits of 64 short-term sets and
> 32 long-term references so drivers cannot later index beyond those
> controls.
> 
> Also reject EXT SPS ST RPS entries whose negative or positive picture
> counts exceed the 16-entry arrays, or whose combined delta-POC count
> exceeds the HEVC DPB maximum.
> 
> Fixes: c9a59dc2acc7 ("media: rkvdec: Add HEVC support for the VDPU381 variant")
> Cc: stable@vger.kernel.org
> Suggested-by: Detlev Casanova <detlev.casanova@collabora.com>
> Assisted-by: Claude:claude-opus-4-7
> Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>

Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>

> ---
>  drivers/media/v4l2-core/v4l2-ctrls-core.c | 15 +++++++++++++++
>  1 file changed, 15 insertions(+)
> 
> diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c
> index 6b375720e395c..a1d773e5de20c 100644
> --- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
> +++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
> @@ -16,6 +16,9 @@
>  
>  static const union v4l2_ctrl_ptr ptr_null;
>  
> +#define V4L2_HEVC_MAX_SHORT_TERM_REF_PIC_SETS	64
> +#define V4L2_HEVC_MAX_LONG_TERM_REF_PICS_SPS	32
> +
>  static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl,
>  		       u32 changes)
>  {
> @@ -1213,6 +1216,10 @@ static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,
>  	case V4L2_CTRL_TYPE_HEVC_SPS:
>  		p_hevc_sps = p;
>  
> +		if (p_hevc_sps->num_short_term_ref_pic_sets >
> +		    V4L2_HEVC_MAX_SHORT_TERM_REF_PIC_SETS)
> +			return -EINVAL;
> +
>  		if (!(p_hevc_sps->flags & V4L2_HEVC_SPS_FLAG_PCM_ENABLED)) {
>  			p_hevc_sps->pcm_sample_bit_depth_luma_minus1 = 0;
>  			p_hevc_sps->pcm_sample_bit_depth_chroma_minus1 = 0;
> @@ -1223,6 +1230,9 @@ static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,
>  		if (!(p_hevc_sps->flags &
>  		      V4L2_HEVC_SPS_FLAG_LONG_TERM_REF_PICS_PRESENT))
>  			p_hevc_sps->num_long_term_ref_pics_sps = 0;
> +		else if (p_hevc_sps->num_long_term_ref_pics_sps >
> +			 V4L2_HEVC_MAX_LONG_TERM_REF_PICS_SPS)
> +			return -EINVAL;
>  		break;
>  
>  	case V4L2_CTRL_TYPE_HEVC_PPS:
> @@ -1267,6 +1277,11 @@ static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,
>  
>  		if (p_hevc_st_rps->flags & ~V4L2_HEVC_EXT_SPS_ST_RPS_FLAG_INTER_REF_PIC_SET_PRED)
>  			return -EINVAL;
> +		if (p_hevc_st_rps->num_negative_pics > 16 ||
> +		    p_hevc_st_rps->num_positive_pics > 16 ||
> +		    p_hevc_st_rps->num_negative_pics +
> +		    p_hevc_st_rps->num_positive_pics > 16)
> +			return -EINVAL;
>  		break;
>  
>  	case V4L2_CTRL_TYPE_HEVC_EXT_SPS_LT_RPS:

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]