| Message ID | 20240126214651.22783-3-michael@niedermayer.cc |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel,1/3] avcodec/vvc/vvcdec: Do not submit frames without VVCFrameThread | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On 1/26/2024 6:46 PM, Michael Niedermayer wrote: > "When aps_params_type is equal to ALF_APS or SCALING_APS, the value of aps_adaptation_parameter_set_id shall be > in the range of 0 to 7, inclusive. > When aps_params_type is equal to LMCS_APS, the value of aps_adaptation_parameter_set_id shall be in the range of 0 > to 3, inclusive." This should be checked in CBS instead, and not one of its users. Something like: > diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c > index 549d021211..9fd8399f0e 100644 > --- a/libavcodec/cbs_h266_syntax_template.c > +++ b/libavcodec/cbs_h266_syntax_template.c > @@ -2455,6 +2455,7 @@ static int FUNC(scaling_list_data)(CodedBitstreamContext *ctx, RWContext *rw, > static int FUNC(aps)(CodedBitstreamContext *ctx, RWContext *rw, > H266RawAPS *current, int prefix) > { > + int aps_id_max = MAX_UINT_BITS(5); > int err; > > if (prefix) > @@ -2467,7 +2468,12 @@ static int FUNC(aps)(CodedBitstreamContext *ctx, RWContext *rw, > : VVC_SUFFIX_APS_NUT)); > > ub(3, aps_params_type); > - ub(5, aps_adaptation_parameter_set_id); > + if (current->aps_params_type == VVC_ASP_TYPE_ALF || > + current->aps_params_type == VVC_ASP_TYPE_SCALING) > + aps_id_max = 7; > + else if (current->aps_params_type == VVC_ASP_TYPE_LMCS) > + aps_id_max = 3; > + u(5, aps_adaptation_parameter_set_id, 0, aps_id_max); > flag(aps_chroma_present_flag); > if (current->aps_params_type == VVC_ASP_TYPE_ALF) > CHECK(FUNC(alf_data)(ctx, rw, current));
diff --git a/libavcodec/vvc/vvc_ps.c b/libavcodec/vvc/vvc_ps.c index c2afc0ac932..41589c138d1 100644 --- a/libavcodec/vvc/vvc_ps.c +++ b/libavcodec/vvc/vvc_ps.c @@ -991,12 +991,19 @@ int ff_vvc_decode_aps(VVCParamSets *ps, const CodedBitstreamUnit *unit) switch (aps->aps_params_type) { case APS_ALF: + if (aps->aps_adaptation_parameter_set_id >= FF_ARRAY_ELEMS(ps->alf_list)) + return AVERROR_INVALIDDATA; + ret = aps_decode_alf(&ps->alf_list[aps->aps_adaptation_parameter_set_id], aps); break; case APS_LMCS: + if (aps->aps_adaptation_parameter_set_id >= FF_ARRAY_ELEMS(ps->lmcs_list)) + return AVERROR_INVALIDDATA; ff_refstruct_replace(&ps->lmcs_list[aps->aps_adaptation_parameter_set_id], aps); break; case APS_SCALING: + if (aps->aps_adaptation_parameter_set_id >= FF_ARRAY_ELEMS(ps->scaling_list)) + return AVERROR_INVALIDDATA; ret = aps_decode_scaling(&ps->scaling_list[aps->aps_adaptation_parameter_set_id], aps); break; }
"When aps_params_type is equal to ALF_APS or SCALING_APS, the value of aps_adaptation_parameter_set_id shall be in the range of 0 to 7, inclusive. When aps_params_type is equal to LMCS_APS, the value of aps_adaptation_parameter_set_id shall be in the range of 0 to 3, inclusive." Fixes: out of array accesses Fixes: 65932/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-4563412340244480 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/vvc/vvc_ps.c | 7 +++++++ 1 file changed, 7 insertions(+)