Re: [FFmpeg-devel] [PATCH v2] lavc/vvc: Validate IBC block vector

[Nuo Mi <nuomi2021@gmail.com>]

On Wed, Jun 26, 2024 at 1:04 AM Frank Plowman <post@frankplowman.com> wrote:

> From H.266 (V3) (09/2023) p. 321:
>
> It is a requirement of bitstream conformance that the luma block
> vector bvL shall obey the following constraints:
> - CtbSizeY is greater than or equal to
> ((yCb + (bvL[ 1 ] >> 4)) & (CtbSizeY − 1)) + cbHeight
>
> This patch checks this is true, which fixes crashes on fuzzed
> bitstreams.
>
Thank you, Frank,
Applied.

>
> Signed-off-by: Frank Plowman <post@frankplowman.com>
> ---
> Changes since v1:
> * Perform this check when the IBC block vectors are derived, rather than
>   when they are first used.
>
>  libavcodec/vvc/ctu.c | 19 +++++++++++++++----
>  libavcodec/vvc/mvs.c | 21 +++++++++++++++++++--
>  libavcodec/vvc/mvs.h |  4 ++--
>  3 files changed, 36 insertions(+), 8 deletions(-)
>
> diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c
> index 752a06e2f5..1a4ceafc25 100644
> --- a/libavcodec/vvc/ctu.c
> +++ b/libavcodec/vvc/ctu.c
> @@ -1444,20 +1444,25 @@ static void merge_data_block(VVCLocalContext *lc)
>      }
>  }
>
> -static void merge_data_ibc(VVCLocalContext *lc)
> +static int merge_data_ibc(VVCLocalContext *lc)
>  {
>      const VVCFrameContext* fc = lc->fc;
>      const VVCSPS* sps         = fc->ps.sps;
>      MotionInfo *mi            = &lc->cu->pu.mi;
>      int merge_idx             = 0;
> +    int ret;
>
>      mi->pred_flag = PF_IBC;
>
>      if (sps->max_num_ibc_merge_cand > 1)
>          merge_idx = ff_vvc_merge_idx(lc);
>
> -    ff_vvc_luma_mv_merge_ibc(lc, merge_idx, &mi->mv[L0][0]);
> +    ret = ff_vvc_luma_mv_merge_ibc(lc, merge_idx, &mi->mv[L0][0]);
> +    if (ret)
> +        return ret;
>      ff_vvc_store_mv(lc, mi);
> +
> +    return 0;
>  }
>
>  static int hls_merge_data(VVCLocalContext *lc)
> @@ -1466,11 +1471,14 @@ static int hls_merge_data(VVCLocalContext *lc)
>      const VVCPH  *ph            = &fc->ps.ph;
>      const CodingUnit *cu        = lc->cu;
>      PredictionUnit *pu          = &lc->cu->pu;
> +    int ret;
>
>      pu->merge_gpm_flag = 0;
>      pu->mi.num_sb_x = pu->mi.num_sb_y = 1;
>      if (cu->pred_mode == MODE_IBC) {
> -        merge_data_ibc(lc);
> +        ret = merge_data_ibc(lc);
> +        if (ret)
> +            return ret;
>      } else {
>          if (ph->max_num_subblock_merge_cand > 0 && cu->cb_width >= 8 &&
> cu->cb_height >= 8)
>              pu->merge_subblock_flag = ff_vvc_merge_subblock_flag(lc);
> @@ -1596,6 +1604,7 @@ static int mvp_data_ibc(VVCLocalContext *lc)
>      int mvp_l0_flag           = 0;
>      int amvr_shift            = 4;
>      Mv *mv                    = &mi->mv[L0][0];
> +    int ret;
>
>      mi->pred_flag = PF_IBC;
>      mi->num_sb_x  = 1;
> @@ -1607,7 +1616,9 @@ static int mvp_data_ibc(VVCLocalContext *lc)
>      if (sps->r->sps_amvr_enabled_flag && (mv->x || mv->y))
>          amvr_shift = ff_vvc_amvr_shift(lc, pu->inter_affine_flag,
> cu->pred_mode, 1);
>
> -    ff_vvc_mvp_ibc(lc, mvp_l0_flag, amvr_shift, mv);
> +    ret = ff_vvc_mvp_ibc(lc, mvp_l0_flag, amvr_shift, mv);
> +    if (ret)
> +        return ret;
>      ff_vvc_store_mv(lc, mi);
>
>      return 0;
> diff --git a/libavcodec/vvc/mvs.c b/libavcodec/vvc/mvs.c
> index 42564b3e6f..1788a7150b 100644
> --- a/libavcodec/vvc/mvs.c
> +++ b/libavcodec/vvc/mvs.c
> @@ -1695,17 +1695,34 @@ static void ibc_merge_candidates(VVCLocalContext
> *lc, const int merge_idx, Mv *m
>      memset(mv, 0, sizeof(*mv));
>  }
>
> -void ff_vvc_mvp_ibc(VVCLocalContext *lc, const int mvp_l0_flag, const int
> amvr_shift, Mv *mv)
> +static int ibc_check_mv(VVCLocalContext *lc, Mv *mv)
> +{
> +    const VVCFrameContext *fc = lc->fc;
> +    const VVCSPS *sps         = lc->fc->ps.sps;
> +    const CodingUnit *cu      = lc->cu;
> +    const Mv *bv              = &cu->pu.mi.mv[L0][0];
> +
> +    if (sps->ctb_size_y < ((cu->y0 + (bv->y >> 4)) & (sps->ctb_size_y -
> 1)) + cu->cb_height) {
> +        av_log(fc->log_ctx, AV_LOG_ERROR, "IBC region spans multiple
> CTBs.\n");
> +        return AVERROR_INVALIDDATA;
> +    }
> +
> +    return 0;
> +}
> +
> +int ff_vvc_mvp_ibc(VVCLocalContext *lc, const int mvp_l0_flag, const int
> amvr_shift, Mv *mv)
>  {
>      LOCAL_ALIGNED_8(Mv, mvp, [1]);
>
>      ibc_merge_candidates(lc, mvp_l0_flag, mvp);
>      ibc_add_mvp(mv, mvp, amvr_shift);
> +    return ibc_check_mv(lc, mv);
>  }
>
> -void ff_vvc_luma_mv_merge_ibc(VVCLocalContext *lc, const int merge_idx,
> Mv *mv)
> +int ff_vvc_luma_mv_merge_ibc(VVCLocalContext *lc, const int merge_idx, Mv
> *mv)
>  {
>      ibc_merge_candidates(lc, merge_idx, mv);
> +    return ibc_check_mv(lc, mv);
>  }
>
>  static int affine_mvp_constructed_cp(NeighbourContext *ctx,
> diff --git a/libavcodec/vvc/mvs.h b/libavcodec/vvc/mvs.h
> index 3f0c8b08e9..b2242b2a4d 100644
> --- a/libavcodec/vvc/mvs.h
> +++ b/libavcodec/vvc/mvs.h
> @@ -30,9 +30,9 @@ void ff_vvc_clip_mv(Mv *mv);
>  void ff_vvc_mv_scale(Mv *dst, const Mv *src, int td, int tb);
>  void ff_vvc_luma_mv_merge_mode(VVCLocalContext *lc, int merge_idx, int
> ciip_flag, MvField *mv);
>  void ff_vvc_luma_mv_merge_gpm(VVCLocalContext *lc, const int
> merge_gpm_idx[2], MvField *mv);
> -void ff_vvc_luma_mv_merge_ibc(VVCLocalContext *lc, int merge_idx, Mv *mv);
> +int ff_vvc_luma_mv_merge_ibc(VVCLocalContext *lc, int merge_idx, Mv *mv);
>  void ff_vvc_mvp(VVCLocalContext *lc, const int *mvp_lx_flag, const int
> amvr_shift,  MotionInfo *mi);
> -void ff_vvc_mvp_ibc(VVCLocalContext *lc, int mvp_l0_flag, int amvr_shift,
> Mv *mv);
> +int ff_vvc_mvp_ibc(VVCLocalContext *lc, int mvp_l0_flag, int amvr_shift,
> Mv *mv);
>  void ff_vvc_sb_mv_merge_mode(VVCLocalContext *lc, int merge_subblock_idx,
> PredictionUnit *pu);
>  void ff_vvc_affine_mvp(VVCLocalContext *lc, const int *mvp_lx_flag, const
> int amvr_shift, MotionInfo* mi);
>  void ff_vvc_store_sb_mvs(const VVCLocalContext *lc, PredictionUnit *pu);
> --
> 2.45.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".