On Wed, Jun 26, 2024 at 1:04 AM Frank Plowman <p...@frankplowman.com> wrote:
> From H.266 (V3) (09/2023) p. 321:
>
> It is a requirement of bitstream conformance that the luma block
> vector bvL shall obey the following constraints:
> - CtbSizeY is greater than or equal to
> ((yCb + (bvL[ 1 ] >> 4)) & (CtbSizeY − 1)) + cbHeight
>
> This patch checks this is true, which fixes crashes on fuzzed
> bitstreams.
>
Thank you, Frank,
Applied.
>
> Signed-off-by: Frank Plowman <p...@frankplowman.com>
> ---
> Changes since v1:
> * Perform this check when the IBC block vectors are derived, rather than
> when they are first used.
>
> libavcodec/vvc/ctu.c | 19 +++++++++++++++----
> libavcodec/vvc/mvs.c | 21 +++++++++++++++++++--
> libavcodec/vvc/mvs.h | 4 ++--
> 3 files changed, 36 insertions(+), 8 deletions(-)
>
> diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c
> index 752a06e2f5..1a4ceafc25 100644
> --- a/libavcodec/vvc/ctu.c
> +++ b/libavcodec/vvc/ctu.c
> @@ -1444,20 +1444,25 @@ static void merge_data_block(VVCLocalContext *lc)
> }
> }
>
> -static void merge_data_ibc(VVCLocalContext *lc)
> +static int merge_data_ibc(VVCLocalContext *lc)
> {
> const VVCFrameContext* fc = lc->fc;
> const VVCSPS* sps = fc->ps.sps;
> MotionInfo *mi = &lc->cu->pu.mi;
> int merge_idx = 0;
> + int ret;
>
> mi->pred_flag = PF_IBC;
>
> if (sps->max_num_ibc_merge_cand > 1)
> merge_idx = ff_vvc_merge_idx(lc);
>
> - ff_vvc_luma_mv_merge_ibc(lc, merge_idx, &mi->mv[L0][0]);
> + ret = ff_vvc_luma_mv_merge_ibc(lc, merge_idx, &mi->mv[L0][0]);
> + if (ret)
> + return ret;
> ff_vvc_store_mv(lc, mi);
> +
> + return 0;
> }
>
> static int hls_merge_data(VVCLocalContext *lc)
> @@ -1466,11 +1471,14 @@ static int hls_merge_data(VVCLocalContext *lc)
> const VVCPH *ph = &fc->ps.ph;
> const CodingUnit *cu = lc->cu;
> PredictionUnit *pu = &lc->cu->pu;
> + int ret;
>
> pu->merge_gpm_flag = 0;
> pu->mi.num_sb_x = pu->mi.num_sb_y = 1;
> if (cu->pred_mode == MODE_IBC) {
> - merge_data_ibc(lc);
> + ret = merge_data_ibc(lc);
> + if (ret)
> + return ret;
> } else {
> if (ph->max_num_subblock_merge_cand > 0 && cu->cb_width >= 8 &&
> cu->cb_height >= 8)
> pu->merge_subblock_flag = ff_vvc_merge_subblock_flag(lc);
> @@ -1596,6 +1604,7 @@ static int mvp_data_ibc(VVCLocalContext *lc)
> int mvp_l0_flag = 0;
> int amvr_shift = 4;
> Mv *mv = &mi->mv[L0][0];
> + int ret;
>
> mi->pred_flag = PF_IBC;
> mi->num_sb_x = 1;
> @@ -1607,7 +1616,9 @@ static int mvp_data_ibc(VVCLocalContext *lc)
> if (sps->r->sps_amvr_enabled_flag && (mv->x || mv->y))
> amvr_shift = ff_vvc_amvr_shift(lc, pu->inter_affine_flag,
> cu->pred_mode, 1);
>
> - ff_vvc_mvp_ibc(lc, mvp_l0_flag, amvr_shift, mv);
> + ret = ff_vvc_mvp_ibc(lc, mvp_l0_flag, amvr_shift, mv);
> + if (ret)
> + return ret;
> ff_vvc_store_mv(lc, mi);
>
> return 0;
> diff --git a/libavcodec/vvc/mvs.c b/libavcodec/vvc/mvs.c
> index 42564b3e6f..1788a7150b 100644
> --- a/libavcodec/vvc/mvs.c
> +++ b/libavcodec/vvc/mvs.c
> @@ -1695,17 +1695,34 @@ static void ibc_merge_candidates(VVCLocalContext
> *lc, const int merge_idx, Mv *m
> memset(mv, 0, sizeof(*mv));
> }
>
> -void ff_vvc_mvp_ibc(VVCLocalContext *lc, const int mvp_l0_flag, const int
> amvr_shift, Mv *mv)
> +static int ibc_check_mv(VVCLocalContext *lc, Mv *mv)
> +{
> + const VVCFrameContext *fc = lc->fc;
> + const VVCSPS *sps = lc->fc->ps.sps;
> + const CodingUnit *cu = lc->cu;
> + const Mv *bv = &cu->pu.mi.mv[L0][0];
> +
> + if (sps->ctb_size_y < ((cu->y0 + (bv->y >> 4)) & (sps->ctb_size_y -
> 1)) + cu->cb_height) {
> + av_log(fc->log_ctx, AV_LOG_ERROR, "IBC region spans multiple
> CTBs.\n");
> + return AVERROR_INVALIDDATA;
> + }
> +
> + return 0;
> +}
> +
> +int ff_vvc_mvp_ibc(VVCLocalContext *lc, const int mvp_l0_flag, const int
> amvr_shift, Mv *mv)
> {
> LOCAL_ALIGNED_8(Mv, mvp, [1]);
>
> ibc_merge_candidates(lc, mvp_l0_flag, mvp);
> ibc_add_mvp(mv, mvp, amvr_shift);
> + return ibc_check_mv(lc, mv);
> }
>
> -void ff_vvc_luma_mv_merge_ibc(VVCLocalContext *lc, const int merge_idx,
> Mv *mv)
> +int ff_vvc_luma_mv_merge_ibc(VVCLocalContext *lc, const int merge_idx, Mv
> *mv)
> {
> ibc_merge_candidates(lc, merge_idx, mv);
> + return ibc_check_mv(lc, mv);
> }
>
> static int affine_mvp_constructed_cp(NeighbourContext *ctx,
> diff --git a/libavcodec/vvc/mvs.h b/libavcodec/vvc/mvs.h
> index 3f0c8b08e9..b2242b2a4d 100644
> --- a/libavcodec/vvc/mvs.h
> +++ b/libavcodec/vvc/mvs.h
> @@ -30,9 +30,9 @@ void ff_vvc_clip_mv(Mv *mv);
> void ff_vvc_mv_scale(Mv *dst, const Mv *src, int td, int tb);
> void ff_vvc_luma_mv_merge_mode(VVCLocalContext *lc, int merge_idx, int
> ciip_flag, MvField *mv);
> void ff_vvc_luma_mv_merge_gpm(VVCLocalContext *lc, const int
> merge_gpm_idx[2], MvField *mv);
> -void ff_vvc_luma_mv_merge_ibc(VVCLocalContext *lc, int merge_idx, Mv *mv);
> +int ff_vvc_luma_mv_merge_ibc(VVCLocalContext *lc, int merge_idx, Mv *mv);
> void ff_vvc_mvp(VVCLocalContext *lc, const int *mvp_lx_flag, const int
> amvr_shift, MotionInfo *mi);
> -void ff_vvc_mvp_ibc(VVCLocalContext *lc, int mvp_l0_flag, int amvr_shift,
> Mv *mv);
> +int ff_vvc_mvp_ibc(VVCLocalContext *lc, int mvp_l0_flag, int amvr_shift,
> Mv *mv);
> void ff_vvc_sb_mv_merge_mode(VVCLocalContext *lc, int merge_subblock_idx,
> PredictionUnit *pu);
> void ff_vvc_affine_mvp(VVCLocalContext *lc, const int *mvp_lx_flag, const
> int amvr_shift, MotionInfo* mi);
> void ff_vvc_store_sb_mvs(const VVCLocalContext *lc, PredictionUnit *pu);
> --
> 2.45.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
