[FFmpeg-devel] [PATCH] lavc/vvc: Validate IBC block vector

[Frank Plowman]

On 25/06/2024 15:19, Nuo Mi wrote:
> On Mon, Jun 24, 2024 at 9:31 PM Frank Plowman <post at frankplowman.com> wrote:
> 
>> From H.266 (V3) (09/2023) p. 321:
>>
>> It is a requirement of bitstream conformance that the luma block
>> vector bvL shall obey the following constraints:
>> - CtbSizeY is greater than or equal to
>> ((yCb + (bvL[ 1 ] >> 4)) & (CtbSizeY − 1)) + cbHeight
>>
>> This patch checks this is true, which fixes crashes on fuzzed
>> bitstreams.
>>
>> Signed-off-by: Frank Plowman <post at frankplowman.com>
>> ---
>>  libavcodec/vvc/intra.c  | 25 ++++++++++++++++++++++---
>>  libavcodec/vvc/thread.c |  4 +---
>>  2 files changed, 23 insertions(+), 6 deletions(-)
>>
>> diff --git a/libavcodec/vvc/intra.c b/libavcodec/vvc/intra.c
>> index f77a012f09..11371db797 100644
>> --- a/libavcodec/vvc/intra.c
>> +++ b/libavcodec/vvc/intra.c
>> @@ -624,15 +624,26 @@ static void intra_block_copy(const VVCLocalContext
>> *lc, const int c_idx)
>>      }
>>  }
>>
>> -static void vvc_predict_ibc(const VVCLocalContext *lc)
>> +static int vvc_predict_ibc(const VVCLocalContext *lc)
>>  {
>> -    const H266RawSPS *rsps = lc->fc->ps.sps->r;
>> +    const VVCFrameContext *fc = lc->fc;
>> +    const VVCSPS *sps         = lc->fc->ps.sps;
>> +    const H266RawSPS *rsps    = sps->r;
>> +    const CodingUnit *cu      = lc->cu;
>> +    const Mv *bv              = &cu->pu.mi.mv[L0][0];
>> +
>> +    if (sps->ctb_size_y < ((cu->y0 + (bv->y >> 4)) & (sps->ctb_size_y -
>> 1)) + cu->cb_height) {
>> +        av_log(fc->log_ctx, AV_LOG_ERROR, "IBC region spans multiple
>> CTBs.\n");
>> +        return AVERROR_INVALIDDATA;
>> +    }
> 
> Hi Frank,
> Thank you for the patch.
> Could we wrap it as a function and call it in ff_vvc_mvp_ibc and
> ff_vvc_luma_mv_merge_ibc?
> This will help us detect errors earlier.
> 

I agree that's a better place to do the check.  I didn't realise the
code paths were already so separate for IBC there.  v2 sent.

Cheers,
--
Frank