[FFmpeg-devel] Re: [PATCH] avcodec/vvc: validate reference picture list indices

[Frank Plowman via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

[-- Attachment #1.1.1.1: Type: text/plain, Size: 1857 bytes --]

On 06/01/2026 07:58, Christophe Gisquet via ffmpeg-devel wrote:
> Hi,
> 
> sorry in advance for any bad formatting in my reply from a phone.
> 
> Le mar. 6 janv. 2026, 03:13, 0xBat via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>
> a écrit
> 
>> ---
>>  libavcodec/vvc/ctu.c | 2 ++
>>  1 file changed, 2 insertions(+)
>>
>> diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c
>> index 18cbe0fe0f..8e4f003886 100644
>> --- a/libavcodec/vvc/ctu.c
>> +++ b/libavcodec/vvc/ctu.c
>> @@ -1287,6 +1287,8 @@ static void derive_mmvd(const VVCLocalContext *lc,
>> MvField *mvf, const Mv *mmvd_
>>      if (mvf->pred_flag == PF_BI) {
>>          const RefPicList *rpl = sc->rpl;
>>          const int poc = lc->fc->ps.ph.poc;
>> +        if (mvf->ref_idx[L0] >= rpl[L0].nb_refs || mvf->ref_idx[L1] >=
>> rpl[L1].nb_refs)
>> +            return;
>>          const int diff[] = {
>>              poc - rpl[L0].refs[mvf->ref_idx[L0]].poc,
>>
> 
> Not a maintainer or contributor to the VVC decoder, but sounds fishy. That
> a ref_idx is invalid, means that wherever it came from didn't validate
> against the RPL. I don't know where mvf comes from, but if that's from the
> current frame, it is extremely weird.
> 
> And by that I mean, the issue sounds like it should be caught earlier to
> avoid it from propagating to other places.
> 
> Regards,
> Christophe
> 

Hi,

Yes I agree with Christophe.  MMVD takes its "base MVs" (what is called
mvf here) from the regular merge list, which is shared with various
other merge modes.  Consequently, if there are invalid MVs in MMVD then
I suspect the issue may be more fundamental and there may be issues with
other merge modes.

I'm guessing you have fuzzed bitstreams which led you to these issues,
would it be possible to share them?

Thanks a lot for your work,
Frank

[-- Attachment #1.1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 1091 bytes --]

[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 236 bytes --]

[-- Attachment #2: Type: text/plain, Size: 163 bytes --]

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org