From patchwork Sat Feb 3 17:21:09 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Frank Plowman X-Patchwork-Id: 45995 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:1a28:b0:199:de12:6fa6 with SMTP id cj40csp1658368pzb; Sat, 3 Feb 2024 09:22:09 -0800 (PST) X-Google-Smtp-Source: AGHT+IF+7gB7O1ZRGM5V2H5HB6qQSaEfftEbqHWhTSf6oUXF7rBdeivVUBGMdVF8/PS1UGBUJ7ta X-Received: by 2002:a17:906:3296:b0:a36:f27b:f0e with SMTP id 22-20020a170906329600b00a36f27b0f0emr3452580ejw.7.1706980929455; Sat, 03 Feb 2024 09:22:09 -0800 (PST) X-Forwarded-Encrypted: i=1; AJvYcCUmMhPyAC4rsTyip8zmfOpXhGHTsdJwb3B1JOQBdQWsQ2ALHmptfAxrvsTIXtNHu2Hemk8c7VBkxrPm82Cb4n3uIY2IYYBRHbVoSo/m6RxUt1HcLPGfRNMMJmeewL2guX78rYEQyv89W2zmAVfXD3hC/YBvZmL2w0NKRQR7Ux6LRvEV48XWeIzKJ6pcGTX6co+i1ATtMhd5hWkzDBEVYOrVemhz+eh/oxbTLjXjkMP6L5+SjufIYWlNukGYupRxdwxqby6deNdqiZaPaXIJxJ6GmcCVYXIUeAP8ehOdKphIXLa7jBwMCrg23uXvMRH40QNbQtPyUMG74KtVvJ9gRRFIpE1cd4KgcXo5qtftK40Q3Rjua4qTlIxoxWIu2EM0+RROVAHaIclVFmy5Z/CnNFAAdiscc3oFCWaXkMF28BYIhw3RNm+UgY7aLrfiEGGNKLtyIB0iKXBWpn8VMgGXtPx8opDoI8+Ljf0W2R/b00L7pAOzHpunmL3vD8MgqCqUByML6ZOa7eyN/vhLxoGoZz3QHhC6nOFdAwcTNs2fH6jf/DBNy7+VUxBNLkRdBgFe3HsPBbMJPOHD2uDE/XKUBH1RQF7on8bASxnLoVXSa1zdatr2+AxdxbGkpqyXVee1EuXVuL6C1t8lOnZY/YsXKBBGcDWOlOlB4WBoC0WeRMjLeQgfS1xSWktKfLwmJbOH/jZw3rY1xMGmOnTO6g407HbKSheRvtZGc4OAe/ltKB+VsQcSuqYXLuL2nJCHRpkjdFDam9gS2ZRMenk4AMkU95/9408ZSOOvGhdPzQriNvOSy9cgOKg/kKv/vxWVVO3g/47Oawr6LDp6E4jVvKcXn59dm2ELfbShyPRjLInoe7P3V3kBSompSLyu7gkSndrKaxtNLKsufDRioBKBl+5ta6wnNUcGqGXrUMdERZvMpQUHUFMbFeN7sJVotjUOkvUffTHarq ODALR8LLYvtcC/iFytKQ5a93XmZ4sOEWXQ2qT1Xp7vXHW6NpqhJ/u6FO+sEBdIXQh6K6ketZ3JMK9ok6e9l4TvT/HbiX1iM6an01m814gxJZOw7rbSpyfkNX9iahuPZsxjVKFMkD10tdsUWWATTc94xYPujPtQ3BOFiL7ab0hT7LQBW+/8l9/Qh1pHmVD+ee8m2nSZqLl2ugCfSXRPKwkINRIQlbMqjJXClTDeFYHYOCukIIii7UEGNYsozksPi/g0rzuUcgik0jirz2PoiIf9jcueYbfKd3k/XyB2zzwp8PVoS9chJydehW5Wn2LmSYo8wwJtZFs7byth7XTe2uK4ZoxXpAojmtMIW33XVEYi7Ueg8MvOoS3/8uuNk6P81uR6eYuEdnMZ2pP39lvy3aW6XBShyG/isBjhqI5OvOJqFtwxa6eGGNvFnW64LDt9v7ovcOGcUNV1vnG7w/TUP0qcMPwTjUMC3GLewoiIUXWRdkjrV6tsJWYaUO+ngvaLtPYIYYPrIgJQGInUwjJtGmK3MtbVBQ0cCU7JXsF2OoUatElaHX3gSeY5b4aIlH0Z2LI7nPCy0js1/aery2B2dY1Ziud4pn9u70hvn8XS3Jy66EKjmndATOO04IdPPsdZG9uNTXfcAWbRmCCPZZrXvw== Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id dt1-20020a170906b78100b00a36fe9bc5bfsi1881368ejb.469.2024.02.03.09.22.08; Sat, 03 Feb 2024 09:22:09 -0800 (PST) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@frankplowman.com header.s=zmail header.b=MwMNu1fS; arc=fail (body hash mismatch); spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id EFE4568D0DD; Sat, 3 Feb 2024 19:22:05 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from sender21-mail.zoho.eu (sender11-op-o12.zoho.eu [31.186.226.226]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 384A068C954 for ; Sat, 3 Feb 2024 19:21:59 +0200 (EET) Delivered-To: post@frankplowman.com ARC-Seal: i=1; a=rsa-sha256; t=1706980915; cv=none; d=zohomail.eu; s=zohoarc; b=UGAOhMRgghjBmrHy3EoE/dlkQoyuCR0V3wMKPw5zLmsF93IScHtGZ4kSWy/pU8QjhAKyt/+VZEpWbyiMnboZ7je38hjc5atXIhl3yhdp3eEEwhEV6hpjO4HqoPKwd4corXysR4Vn259qczaKy9OAfk9jqS7+32a2uM/1k0Hvd5k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.eu; s=zohoarc; t=1706980915; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=pLwdRzXOwK0IRiU8JjIt0zncUjJsFK5A1AeQCnJuMYk=; b=QSOFxKDIVkmfFNsxmxC+9TfxH8xsXZb/c1w5muz7Y1Gq8Hzcx1r+l9NTIq8GC5o8XB2HMGczbP9JBXqjAUTh6+rx6vZC51rlYcPS+nBZEo0uVVVlMMtFkHjctbCCGf98wspQ4/8Q4lF0J45UkQBswZblJg92q2JQMlJP+V1KoAY= ARC-Authentication-Results: i=1; mx.zohomail.eu; dkim=pass header.i=frankplowman.com; spf=pass smtp.mailfrom=post@frankplowman.com; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1706980915; s=zmail; d=frankplowman.com; i=post@frankplowman.com; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=pLwdRzXOwK0IRiU8JjIt0zncUjJsFK5A1AeQCnJuMYk=; b=MwMNu1fSRSeQabA/Ttkm7/JvFTHV+M95RESg7CXPWuKx2g70PBg/NNhombHbwMbn 07lGDeOSZFyBkLceQN1pXf19U+7FHtTqXHjDZ1D21Fhj9jpIXVdB8+crIYZh4O2YLL+ 7dQnnd+6nlquGWVSXbBssRucPN36NlTQjxoQ+u7s= Received: from localhost.localdomain (185.175.219.1 [185.175.219.1]) by mx.zoho.eu with SMTPS id 1706980913529412.04446234216243; Sat, 3 Feb 2024 18:21:53 +0100 (CET) From: post@frankplowman.com To: ffmpeg-devel@ffmpeg.org Date: Sat, 3 Feb 2024 18:21:09 +0100 Message-ID: <20240203172109.20149-1-post@frankplowman.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-ZohoMailClient: External Subject: [FFmpeg-devel] [PATCH] lavc/vvc: Validate alf_list indexes X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Frank Plowman Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: NSwjp7UVzSg2 From: Frank Plowman Fixes crashes when decoding illegal bitstreams found by fuzzing. Signed-off-by: Frank Plowman --- libavcodec/vvc/vvc_ctu.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/libavcodec/vvc/vvc_ctu.c b/libavcodec/vvc/vvc_ctu.c index d166b16a19..f601c6c95e 100644 --- a/libavcodec/vvc/vvc_ctu.c +++ b/libavcodec/vvc/vvc_ctu.c @@ -2207,7 +2207,7 @@ static void hls_sao(VVCLocalContext *lc, const int rx, const int ry) } } -static void alf_params(VVCLocalContext *lc, const int rx, const int ry) +static int alf_params(VVCLocalContext *lc, const int rx, const int ry) { const VVCFrameContext *fc = lc->fc; const H266RawSliceHeader *sh = lc->sc->sh.r; @@ -2233,6 +2233,11 @@ static void alf_params(VVCLocalContext *lc, const int rx, const int ry) c_idx == CB ? sh->sh_alf_cb_enabled_flag : sh->sh_alf_cr_enabled_flag; if (alf_enabled_flag) { const VVCALF *aps = fc->ps.alf_list[sh->sh_alf_aps_id_chroma]; + if (!aps) { + // Slice header refers to an APS which does not exist + return AVERROR_INVALIDDATA; + } + alf->ctb_flag[c_idx] = ff_vvc_alf_ctb_flag(lc, rx, ry, c_idx); alf->alf_ctb_filter_alt_idx[c_idx - 1] = 0; if (alf->ctb_flag[c_idx] && aps->num_chroma_filters > 1) @@ -2247,10 +2252,16 @@ static void alf_params(VVCLocalContext *lc, const int rx, const int ry) alf->ctb_cc_idc[i] = 0; if (cc_enabled[i]) { const VVCALF *aps = fc->ps.alf_list[cc_aps_id[i]]; + if (!aps) { + // Slice header refers to an APS which does not exist + return AVERROR_INVALIDDATA; + } alf->ctb_cc_idc[i] = ff_vvc_alf_ctb_cc_idc(lc, rx, ry, i, aps->num_cc_filters[i]); } } } + + return 0; } static void deblock_params(VVCLocalContext *lc, const int rx, const int ry) @@ -2274,7 +2285,9 @@ static int hls_coding_tree_unit(VVCLocalContext *lc, memset(lc->parse.chroma_qp_offset, 0, sizeof(lc->parse.chroma_qp_offset)); hls_sao(lc, x0 >> sps->ctb_log2_size_y, y0 >> sps->ctb_log2_size_y); - alf_params(lc, x0 >> sps->ctb_log2_size_y, y0 >> sps->ctb_log2_size_y); + ret = alf_params(lc, x0 >> sps->ctb_log2_size_y, y0 >> sps->ctb_log2_size_y); + if (ret < 0) + return ret; deblock_params(lc, x0 >> sps->ctb_log2_size_y, y0 >> sps->ctb_log2_size_y); if (IS_I(rsh) && sps->r->sps_qtbtt_dual_tree_intra_flag)