Opened 4 years ago

Closed 4 years ago

#1216 closed defect (fixed)

Out of bounds array access (8.5.6.6.3)

Reported by: fbossen Owned by:
Priority: minor Milestone:
Component: spec Version: VVC D10 vD
Keywords: Cc: ksuehring, bbross, XiangLi, fbossen, jvet@…

Description

It seems that input values refIdxL0 and refIdxL1 may be equal to -1 (for example, see assignments in (456), (519), (649)). In such case, they should not be used to index arrays LumaWeightLX, luma_offset_lX, ChromaWeightLX, and ChromaOffsetLX.

Assignments such as
w0 = LumaWeightL0[ refIdxL0 ]
could be changed to
w0 = ( refIdxL0 >= 0 ) ? LumaWeightL0[ refIdxL0 ] : 0

or the assignment could be conditioned on predFlagL0:
When predFlagL0 is 1, the variables o0 and w0 are derived as follows:

w0 = ( cIdx == 0 ) ? LumaWeightL0[ refIdxL0 ] : ChromaWeightL0[ refIdxL0 ][ cIdx − 1 ]
o0 = ( ( cIdx == 0 ) ? luma_offset_l0[ refIdxL0 ] : ChromaOffsetL0[ refIdxL0 ][ cIdx − 1 ] ) << ( bitDepth − 8 )


Change history (2)

comment:1 Changed 4 years ago by jlchen

Good catch and thanks for reporting the issue. The option 2 is preferable to me since w0 and o0 are not used when predFlag0 is 0.

Will be fixed in JVET-S2001-vE release.

comment:2 Changed 4 years ago by jlchen

  • Resolution set to fixed
  • Status changed from new to closed
Note: See TracTickets for help on using tickets.