virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-04 22:03:09 +02:00
Code Issues Releases Activity

lavc/vvc/plt: validate run and signalled_entries

Browse Source 
Fixes a crash triggered by a fuzzed clip:
https://github.com/ffvvc/tests/tree/main/fuzz/passed/000256.bit

Reproduce with:
ffmpeg -i 000256.bit -f null -
This commit is contained in:
Nuo Mi
2025-05-17 13:51:50 +08:00
parent cbdb5e2477
commit 363a7a34f6
1 changed files with 23 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
libavcodec/vvc/ctu.c
View File

@ -1845,7 +1845,7 @@ static TransformUnit* palette_add_tu(VVCLocalContext *lc, const int start, const
return tu; return tu;
} }
static void palette_predicted(VVCLocalContext *lc, const bool local_dual_tree, int start, int end, static int palette_predicted(VVCLocalContext *lc, const bool local_dual_tree, int start, int end,
bool *predictor_reused, const int predictor_size, const int max_entries) bool *predictor_reused, const int predictor_size, const int max_entries)
{ {
CodingUnit *cu = lc->cu; CodingUnit *cu = lc->cu;
@ -1863,6 +1863,10 @@ static void palette_predicted(VVCLocalContext *lc, const bool local_dual_tree, i
if (run > 1) if (run > 1)
i += run - 1; i += run - 1;
if (i >= predictor_size)
return AVERROR_INVALIDDATA;
predictor_reused[i] = true; predictor_reused[i] = true;
for (int c = start; c < end; c++) for (int c = start; c < end; c++)
cu->plt[c].entries[nb_predicted] = lc->ep->pp[c].entries[i]; cu->plt[c].entries[nb_predicted] = lc->ep->pp[c].entries[i];
@ -1871,9 +1875,11 @@ static void palette_predicted(VVCLocalContext *lc, const bool local_dual_tree, i
for (int c = start; c < end; c++) for (int c = start; c < end; c++)
cu->plt[c].size = nb_predicted; cu->plt[c].size = nb_predicted;
return 0;
} }
static void palette_signaled(VVCLocalContext *lc, const bool local_dual_tree, static int palette_signaled(VVCLocalContext *lc, const bool local_dual_tree,
const int start, const int end, const int max_entries) const int start, const int end, const int max_entries)
{ {
const VVCSPS *sps = lc->fc->ps.sps; const VVCSPS *sps = lc->fc->ps.sps;
@ -1883,6 +1889,9 @@ static void palette_signaled(VVCLocalContext *lc, const bool local_dual_tree,
const int size = nb_predicted + nb_signaled; const int size = nb_predicted + nb_signaled;
const bool dual_tree_luma = local_dual_tree && cu->tree_type == DUAL_TREE_LUMA; const bool dual_tree_luma = local_dual_tree && cu->tree_type == DUAL_TREE_LUMA;
if (size > max_entries)
return AVERROR_INVALIDDATA;
for (int c = start; c < end; c++) { for (int c = start; c < end; c++) {
Palette *plt = cu->plt + c; Palette *plt = cu->plt + c;
for (int i = nb_predicted; i < size; i++) { for (int i = nb_predicted; i < size; i++) {
@ -1894,6 +1903,8 @@ static void palette_signaled(VVCLocalContext *lc, const bool local_dual_tree,
} }
plt->size = size; plt->size = size;
} }
return 0;
} }
static void palette_update_predictor(VVCLocalContext *lc, const bool local_dual_tree, int start, int end, static void palette_update_predictor(VVCLocalContext *lc, const bool local_dual_tree, int start, int end,
@ -2070,7 +2081,7 @@ static int hls_palette_coding(VVCLocalContext *lc, const VVCTreeType tree_type)
int max_index = 0; int max_index = 0;
int prev_run_pos = 0; int prev_run_pos = 0;
int predictor_size, start, end; int predictor_size, start, end, ret;
bool reused[VVC_MAX_NUM_PALETTE_PREDICTOR_SIZE]; bool reused[VVC_MAX_NUM_PALETTE_PREDICTOR_SIZE];
uint8_t run_type[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE]; uint8_t run_type[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE];
uint8_t index[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE]; uint8_t index[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE];
@ -2082,8 +2093,15 @@ static int hls_palette_coding(VVCLocalContext *lc, const VVCTreeType tree_type)
predictor_size = pp[start].size; predictor_size = pp[start].size;
memset(reused, 0, sizeof(reused[0]) * predictor_size); memset(reused, 0, sizeof(reused[0]) * predictor_size);
palette_predicted(lc, local_dual_tree, start, end, reused, predictor_size, max_entries);
palette_signaled(lc, local_dual_tree, start, end, max_entries); ret = palette_predicted(lc, local_dual_tree, start, end, reused, predictor_size, max_entries);
if (ret < 0)
return ret;
ret = palette_signaled(lc, local_dual_tree, start, end, max_entries);
if (ret < 0)
return ret;
palette_update_predictor(lc, local_dual_tree, start, end, reused, predictor_size); palette_update_predictor(lc, local_dual_tree, start, end, reused, predictor_size);
if (cu->plt[start].size > 0) if (cu->plt[start].size > 0)