This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch release/7.1
in repository ffmpeg.

commit 43e9c091dd4bf917a0ae79b5ef87fee594386e52
Author:     Frank Plowman <[email protected]>
AuthorDate: Fri Jan 10 21:29:07 2025 +0000
Commit:     Frank Plowman <[email protected]>
CommitDate: Wed Jun 10 15:12:21 2026 +0100

    lavc/vvc: Check slice structure
    
    The criteria for slice structure validity is similar to that of
    subpicture structure validity that we saw not too long ago [1].
    The relationship between tiles and slices must satisfy the following
    properties:
    
    * Exhaustivity.  All tiles in a picture must belong to a slice.  The
      tiles cover the picture, so this implies the slices must cover the
      picture.
    * Mutual exclusivity.  No tile may belong to more than one slice, i.e.
      slices may not overlap.
    
    In most cases these properties are guaranteed by the syntax.  There is
    one noticable exception however: when pps_tile_idx_delta_present_flag is
    equal to one, each slice is associated with a syntax element
    pps_tile_idx_delta_val[i] which "specifies the difference between the
    tile index of the tile containing the first CTU in the ( i + 1 )-th
    rectangular slice and the tile index of the tile containing the first
    CTU in the i-th rectangular slice" [2].  When these syntax elements are
    present, the i-th slice can begin anywhere and the usual guarantees
    provided by the syntax are lost.
    
    The patch detects slice structures which violate either of the two
    properties above, and are therefore invalid, while building the
    slice map.  Should the slice map be determined to be invalid, an
    AVERROR_INVALIDDATA is returned.  This prevents issues including
    segmentation faults when trying to decode,  invalid bitstreams.
    
    [1]: https://ffmpeg.org//pipermail/ffmpeg-devel/2024-October/334470.html
    [2]: H.266 (V3) Section 7.4.3.5, Picture parameter set RBSP semantics
    
    Signed-off-by: Frank Plowman <[email protected]>
    (cherry picked from commit 8bd66a8c9587af61c7b46558be3c4ee317c1af5a)
---
 libavcodec/vvc/ps.c | 34 +++++++++++++++++++++++++++-------
 1 file changed, 27 insertions(+), 7 deletions(-)

diff --git a/libavcodec/vvc/ps.c b/libavcodec/vvc/ps.c
index e5d854d899..66f14a059c 100644
--- a/libavcodec/vvc/ps.c
+++ b/libavcodec/vvc/ps.c
@@ -20,6 +20,7 @@
  * License along with FFmpeg; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
+#include <stdbool.h>
 
 #include "libavcodec/cbs_h266.h"
 #include "libavutil/mem.h"
@@ -460,7 +461,7 @@ static int pps_one_tile_slices(VVCPPS *pps, const int 
tile_idx, int i, int *off)
     return i;
 }
 
-static void pps_multi_tiles_slice(VVCPPS *pps, const int tile_idx, const int 
i, int *off)
+static int pps_multi_tiles_slice(VVCPPS *pps, const int tile_idx, const int i, 
int *off, bool *tile_in_slice)
 {
     const H266RawPPS *r = pps->r;
     int rx, ry, tile_x, tile_y;
@@ -470,32 +471,51 @@ static void pps_multi_tiles_slice(VVCPPS *pps, const int 
tile_idx, const int i,
     pps->num_ctus_in_slice[i] = 0;
     for (int ty = tile_y; ty <= tile_y + 
r->pps_slice_height_in_tiles_minus1[i]; ty++) {
         for (int tx = tile_x; tx <= tile_x + 
r->pps_slice_width_in_tiles_minus1[i]; tx++) {
+            const int idx = ty * r->num_tile_columns + tx;
+            if (tile_in_slice[idx])
+                return AVERROR_INVALIDDATA;
+            tile_in_slice[idx] = true;
             ctu_xy(&rx, &ry, tx, ty, pps);
             pps->num_ctus_in_slice[i] += pps_add_ctus(pps, off, rx, ry,
                 r->col_width_val[tx], r->row_height_val[ty]);
         }
     }
+
+    return 0;
 }
 
-static void pps_rect_slice(VVCPPS *pps, const VVCSPS *sps)
+static int pps_rect_slice(VVCPPS *pps, const VVCSPS *sps)
 {
     const H266RawPPS *r = pps->r;
+    bool tile_in_slice[VVC_MAX_TILES_PER_AU] = {false};
     int tile_idx = 0, off = 0;
 
     if (r->pps_single_slice_per_subpic_flag) {
         pps_single_slice_per_subpic(pps, sps, &off);
-        return;
+        return 0;
     }
 
     for (int i = 0; i < r->pps_num_slices_in_pic_minus1 + 1; i++) {
         if (!r->pps_slice_width_in_tiles_minus1[i] &&
             !r->pps_slice_height_in_tiles_minus1[i]) {
+            if (tile_in_slice[tile_idx])
+                return AVERROR_INVALIDDATA;
+            tile_in_slice[tile_idx] = true;
             i = pps_one_tile_slices(pps, tile_idx, i, &off);
         } else {
-            pps_multi_tiles_slice(pps, tile_idx, i, &off);
+            const int ret = pps_multi_tiles_slice(pps, tile_idx, i, &off, 
tile_in_slice);
+            if (ret < 0)
+                return ret;
         }
         tile_idx = next_tile_idx(tile_idx, i, r);
     }
+
+    for (int i = 0; i < r->num_tiles_in_pic; i++) {
+        if (!tile_in_slice[i])
+            return AVERROR_INVALIDDATA;
+    }
+
+    return 0;
 }
 
 static void pps_no_rect_slice(VVCPPS* pps)
@@ -518,9 +538,9 @@ static int pps_slice_map(VVCPPS *pps, const VVCSPS *sps)
         return AVERROR(ENOMEM);
 
     if (pps->r->pps_rect_slice_flag)
-        pps_rect_slice(pps, sps);
-    else
-        pps_no_rect_slice(pps);
+        return pps_rect_slice(pps, sps);
+
+    pps_no_rect_slice(pps);
 
     return 0;
 }

_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to