[FFmpeg-devel] [PATCH] lavc/vvc: Validate IBC block vector

[Frank Plowman]

>From H.266 (V3) (09/2023) p. 321:

It is a requirement of bitstream conformance that the luma block
vector bvL shall obey the following constraints:
- CtbSizeY is greater than or equal to
((yCb + (bvL[ 1 ] >> 4)) & (CtbSizeY − 1)) + cbHeight

This patch checks this is true, which fixes crashes on fuzzed
bitstreams.

Signed-off-by: Frank Plowman <post at frankplowman.com>
---
 libavcodec/vvc/intra.c  | 25 ++++++++++++++++++++++---
 libavcodec/vvc/thread.c |  4 +---
 2 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/libavcodec/vvc/intra.c b/libavcodec/vvc/intra.c
index f77a012f09..11371db797 100644
--- a/libavcodec/vvc/intra.c
+++ b/libavcodec/vvc/intra.c
@@ -624,15 +624,26 @@ static void intra_block_copy(const VVCLocalContext *lc, const int c_idx)
     }
 }
 
-static void vvc_predict_ibc(const VVCLocalContext *lc)
+static int vvc_predict_ibc(const VVCLocalContext *lc)
 {
-    const H266RawSPS *rsps = lc->fc->ps.sps->r;
+    const VVCFrameContext *fc = lc->fc;
+    const VVCSPS *sps         = lc->fc->ps.sps;
+    const H266RawSPS *rsps    = sps->r;
+    const CodingUnit *cu      = lc->cu;
+    const Mv *bv              = &cu->pu.mi.mv[L0][0];
+
+    if (sps->ctb_size_y < ((cu->y0 + (bv->y >> 4)) & (sps->ctb_size_y - 1)) + cu->cb_height) {
+        av_log(fc->log_ctx, AV_LOG_ERROR, "IBC region spans multiple CTBs.\n");
+        return AVERROR_INVALIDDATA;
+    }
 
     intra_block_copy(lc, LUMA);
     if (lc->cu->tree_type == SINGLE_TREE && rsps->sps_chroma_format_idc) {
         intra_block_copy(lc, CB);
         intra_block_copy(lc, CR);
     }
+
+    return 0;
 }
 
 static void ibc_fill_vir_buf(const VVCLocalContext *lc, const CodingUnit *cu)
@@ -678,7 +689,10 @@ int ff_vvc_reconstruct(VVCLocalContext *lc, const int rs, const int rx, const in
         if (cu->ciip_flag)
             ff_vvc_predict_ciip(lc);
         else if (cu->pred_mode == MODE_IBC)
-            vvc_predict_ibc(lc);
+            ret = vvc_predict_ibc(lc);
+        if (ret)
+            goto fail;
+
         if (cu->coded_flag) {
             ret = reconstruct(lc);
         } else {
@@ -687,10 +701,15 @@ int ff_vvc_reconstruct(VVCLocalContext *lc, const int rs, const int rx, const in
             if (sps->r->sps_chroma_format_idc && cu->tree_type != DUAL_TREE_LUMA)
                 add_reconstructed_area(lc, CHROMA, cu->x0, cu->y0, cu->cb_width, cu->cb_height);
         }
+        if (ret)
+            goto fail;
+
         if (sps->r->sps_ibc_enabled_flag)
             ibc_fill_vir_buf(lc, cu);
         cu = cu->next;
     }
+
+fail:
     ff_vvc_ctu_free_cus(ctu);
     return ret;
 }
diff --git a/libavcodec/vvc/thread.c b/libavcodec/vvc/thread.c
index 8777d380bf..5b01dd2d20 100644
--- a/libavcodec/vvc/thread.c
+++ b/libavcodec/vvc/thread.c
@@ -454,9 +454,7 @@ static int run_inter(VVCContext *s, VVCLocalContext *lc, VVCTask *t)
 
 static int run_recon(VVCContext *s, VVCLocalContext *lc, VVCTask *t)
 {
-    ff_vvc_reconstruct(lc, t->rs, t->rx, t->ry);
-
-    return 0;
+    return ff_vvc_reconstruct(lc, t->rs, t->rx, t->ry);
 }
 
 static int run_lmcs(VVCContext *s, VVCLocalContext *lc, VVCTask *t)
-- 
2.45.1