Description
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdec_av1_slice_setup_tile() copies tile_cols + 1 / tile_rows + 1 entries into mi_col_starts[] / mi_row_starts[] from the bitstream tile_info. Bound the copy to the array capacity.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0934d37596151edce115c6d0843a9ad7d5e5d232 to < f19acf00818a9eada06a77715d0188c181fb435eaffected0934d37596151edce115c6d0843a9ad7d5e5d232 to < ad47a250afafa3a51cfb4a004463ff28e66c596eaffected0934d37596151edce115c6d0843a9ad7d5e5d232 to < 7992059c045780095ba5a696dcb2f5400a82803caffected0934d37596151edce115c6d0843a9ad7d5e5d232 to < eb0ea3898e3921900939e30c3946dd2b52281859affected0934d37596151edce115c6d0843a9ad7d5e5d232 to < 37bef2170d4c88fc3d708eecf3ef0f4032bc1372affected
Linux Linux
Default version status: affected
6.6affected0 to < 6.6unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2.7 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/f19acf00818a9eada06a77715d0188c181fb435e ↗
- https://git.kernel.org/stable/c/ad47a250afafa3a51cfb4a004463ff28e66c596e ↗
- https://git.kernel.org/stable/c/7992059c045780095ba5a696dcb2f5400a82803c ↗
- https://git.kernel.org/stable/c/eb0ea3898e3921900939e30c3946dd2b52281859 ↗
- https://git.kernel.org/stable/c/37bef2170d4c88fc3d708eecf3ef0f4032bc1372 ↗