On 05/02/2024 13:45, Nuo Mi wrote:
On Sun, Feb 4, 2024 at 1:22 AM <p...@frankplowman.com> wrote:From: Frank Plowman <p...@frankplowman.com> Fixes crashes when decoding illegal bitstreams found by fuzzing. Signed-off-by: Frank Plowman <p...@frankplowman.com> --- libavcodec/vvc/vvc_ctu.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/libavcodec/vvc/vvc_ctu.c b/libavcodec/vvc/vvc_ctu.c index d166b16a19..f601c6c95e 100644 --- a/libavcodec/vvc/vvc_ctu.c +++ b/libavcodec/vvc/vvc_ctu.c @@ -2207,7 +2207,7 @@ static void hls_sao(VVCLocalContext *lc, const int rx, const int ry) } } -static void alf_params(VVCLocalContext *lc, const int rx, const int ry) +static int alf_params(VVCLocalContext *lc, const int rx, const int ry) { const VVCFrameContext *fc = lc->fc; const H266RawSliceHeader *sh = lc->sc->sh.r; @@ -2233,6 +2233,11 @@ static void alf_params(VVCLocalContext *lc, const int rx, const int ry) c_idx == CB ? sh->sh_alf_cb_enabled_flag : sh->sh_alf_cr_enabled_flag; if (alf_enabled_flag) { const VVCALF *aps = fc->ps.alf_list[sh->sh_alf_aps_id_chroma]; + if (!aps) { + // Slice header refers to an APS which does not exist + return AVERROR_INVALIDDATA; + } +Thank you Frank. Since all "if conditions" are related to slices, could we perform the check at sh_derive()?
Yes, I had another look at this yesterday and came to the same conclusion. Do you think it's better to derive pointers to the relevant APSs or just to validate the indices into fps->aps_list?
alf->ctb_flag[c_idx] = ff_vvc_alf_ctb_flag(lc, rx, ry, c_idx); alf->alf_ctb_filter_alt_idx[c_idx - 1] = 0; if (alf->ctb_flag[c_idx] && aps->num_chroma_filters > 1) @@ -2247,10 +2252,16 @@ static void alf_params(VVCLocalContext *lc, const int rx, const int ry) alf->ctb_cc_idc[i] = 0; if (cc_enabled[i]) { const VVCALF *aps = fc->ps.alf_list[cc_aps_id[i]]; + if (!aps) { + // Slice header refers to an APS which does not exist + return AVERROR_INVALIDDATA; + } alf->ctb_cc_idc[i] = ff_vvc_alf_ctb_cc_idc(lc, rx, ry, i, aps->num_cc_filters[i]); } } } + + return 0; } static void deblock_params(VVCLocalContext *lc, const int rx, const int ry) @@ -2274,7 +2285,9 @@ static int hls_coding_tree_unit(VVCLocalContext *lc, memset(lc->parse.chroma_qp_offset, 0, sizeof(lc->parse.chroma_qp_offset)); hls_sao(lc, x0 >> sps->ctb_log2_size_y, y0 >> sps->ctb_log2_size_y); - alf_params(lc, x0 >> sps->ctb_log2_size_y, y0 >> sps->ctb_log2_size_y); + ret = alf_params(lc, x0 >> sps->ctb_log2_size_y, y0 >> sps->ctb_log2_size_y); + if (ret < 0) + return ret; deblock_params(lc, x0 >> sps->ctb_log2_size_y, y0 >> sps->ctb_log2_size_y); if (IS_I(rsh) && sps->r->sps_qtbtt_dual_tree_intra_flag) -- 2.43.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe"._______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
