[FFmpeg-devel] [PATCH] lavc/vvc: Fix divide-by-zero in LMCS param derivation

[FFmpeg-devel] [PATCH] lavc/vvc: Fix divide-by-zero in LMCS param derivation

[Frank Plowman]

Add three missing requirements on bitstream conformance from 7.4.3.19 of
H.266 (V3).  Issue found using fuzzing.

Signed-off-by: Frank Plowman <post@frankplowman.com>
---
 libavcodec/vvc/ps.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/libavcodec/vvc/ps.c b/libavcodec/vvc/ps.c
index 1f3c2edbb7..3228ea6803 100644
--- a/libavcodec/vvc/ps.c
+++ b/libavcodec/vvc/ps.c
@@ -849,7 +849,7 @@ static int lmcs_derive_lut(VVCLMCS *lmcs, const H266RawAPS *rlmcs, const H266Raw
     uint16_t input_pivot[LMCS_MAX_BIN_SIZE];
     uint16_t scale_coeff[LMCS_MAX_BIN_SIZE];
     uint16_t inv_scale_coeff[LMCS_MAX_BIN_SIZE];
-    int i, delta_crs;
+    int i, delta_crs, sum_cw;
     if (bit_depth > LMCS_MAX_BIT_DEPTH)
         return AVERROR_PATCHWELCOME;
 
@@ -860,8 +860,13 @@ static int lmcs_derive_lut(VVCLMCS *lmcs, const H266RawAPS *rlmcs, const H266Raw
     lmcs->max_bin_idx = LMCS_MAX_BIN_SIZE - 1 - rlmcs->lmcs_delta_max_bin_idx;
 
     memset(cw, 0, sizeof(cw));
-    for (int i = lmcs->min_bin_idx; i <= lmcs->max_bin_idx; i++)
+    sum_cw = 0;
+    for (int i = lmcs->min_bin_idx; i <= lmcs->max_bin_idx; i++) {
         cw[i] = org_cw + (1 - 2 * rlmcs->lmcs_delta_sign_cw_flag[i]) * rlmcs->lmcs_delta_abs_cw[i];
+        sum_cw += cw[i];
+    }
+    if (sum_cw > (1 << bit_depth) - 1)
+        return AVERROR_INVALIDDATA;
 
     delta_crs = (1 - 2 * rlmcs->lmcs_delta_sign_crs_flag) * rlmcs->lmcs_delta_abs_crs;
 
@@ -869,13 +874,20 @@ static int lmcs_derive_lut(VVCLMCS *lmcs, const H266RawAPS *rlmcs, const H266Raw
     for (i = 0; i < LMCS_MAX_BIN_SIZE; i++) {
         input_pivot[i]        = i * org_cw;
         lmcs->pivot[i + 1] = lmcs->pivot[i] + cw[i];
+        if (i >= lmcs->min_bin_idx && i <= lmcs->max_bin_idx
+         && lmcs->pivot[i] % (1 << (bit_depth - 5)) != 0
+         && lmcs->pivot[i] >> (bit_depth - 5) == lmcs->pivot[i + 1] >> (bit_depth - 5))
+            return AVERROR_INVALIDDATA;
         scale_coeff[i]        = (cw[i] * (1 << 11) +  off) >> shift;
         if (cw[i] == 0) {
             inv_scale_coeff[i] = 0;
             lmcs->chroma_scale_coeff[i] = (1 << 11);
         } else {
+            const int cw_plus_d = cw[i] + delta_crs;
+            if (cw_plus_d < (org_cw >> 3) || cw_plus_d > ((org_cw << 3) - 1))
+                return AVERROR_INVALIDDATA;
             inv_scale_coeff[i] = org_cw * (1 << 11) / cw[i];
-            lmcs->chroma_scale_coeff[i] = org_cw * (1 << 11) / (cw[i] + delta_crs);
+            lmcs->chroma_scale_coeff[i] = org_cw * (1 << 11) / cw_plus_d;
         }
     }
 
-- 
2.47.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] lavc/vvc: Fix divide-by-zero in LMCS param derivation

[Nuo Mi]

On Sat, May 24, 2025 at 8:13 PM Frank Plowman <post@frankplowman.com> wrote:

> Add three missing requirements on bitstream conformance from 7.4.3.19 of
> H.266 (V3).  Issue found using fuzzing.
>
Thank you, Frank.
Applied with slight style changes.

>
> Signed-off-by: Frank Plowman <post@frankplowman.com>
> ---
>  libavcodec/vvc/ps.c | 18 +++++++++++++++---
>  1 file changed, 15 insertions(+), 3 deletions(-)
>
> diff --git a/libavcodec/vvc/ps.c b/libavcodec/vvc/ps.c
> index 1f3c2edbb7..3228ea6803 100644
> --- a/libavcodec/vvc/ps.c
> +++ b/libavcodec/vvc/ps.c
> @@ -849,7 +849,7 @@ static int lmcs_derive_lut(VVCLMCS *lmcs, const
> H266RawAPS *rlmcs, const H266Raw
>      uint16_t input_pivot[LMCS_MAX_BIN_SIZE];
>      uint16_t scale_coeff[LMCS_MAX_BIN_SIZE];
>      uint16_t inv_scale_coeff[LMCS_MAX_BIN_SIZE];
> -    int i, delta_crs;
> +    int i, delta_crs, sum_cw;
>      if (bit_depth > LMCS_MAX_BIT_DEPTH)
>          return AVERROR_PATCHWELCOME;
>
> @@ -860,8 +860,13 @@ static int lmcs_derive_lut(VVCLMCS *lmcs, const
> H266RawAPS *rlmcs, const H266Raw
>      lmcs->max_bin_idx = LMCS_MAX_BIN_SIZE - 1 -
> rlmcs->lmcs_delta_max_bin_idx;
>
>      memset(cw, 0, sizeof(cw));
> -    for (int i = lmcs->min_bin_idx; i <= lmcs->max_bin_idx; i++)
> +    sum_cw = 0;
> +    for (int i = lmcs->min_bin_idx; i <= lmcs->max_bin_idx; i++) {
>          cw[i] = org_cw + (1 - 2 * rlmcs->lmcs_delta_sign_cw_flag[i]) *
> rlmcs->lmcs_delta_abs_cw[i];
> +        sum_cw += cw[i];
> +    }
> +    if (sum_cw > (1 << bit_depth) - 1)
> +        return AVERROR_INVALIDDATA;
>
>      delta_crs = (1 - 2 * rlmcs->lmcs_delta_sign_crs_flag) *
> rlmcs->lmcs_delta_abs_crs;
>
> @@ -869,13 +874,20 @@ static int lmcs_derive_lut(VVCLMCS *lmcs, const
> H266RawAPS *rlmcs, const H266Raw
>      for (i = 0; i < LMCS_MAX_BIN_SIZE; i++) {
>          input_pivot[i]        = i * org_cw;
>          lmcs->pivot[i + 1] = lmcs->pivot[i] + cw[i];
> +        if (i >= lmcs->min_bin_idx && i <= lmcs->max_bin_idx
> +         && lmcs->pivot[i] % (1 << (bit_depth - 5)) != 0
> +         && lmcs->pivot[i] >> (bit_depth - 5) == lmcs->pivot[i + 1] >>
> (bit_depth - 5))
> +            return AVERROR_INVALIDDATA;
>          scale_coeff[i]        = (cw[i] * (1 << 11) +  off) >> shift;
>          if (cw[i] == 0) {
>              inv_scale_coeff[i] = 0;
>              lmcs->chroma_scale_coeff[i] = (1 << 11);
>          } else {
> +            const int cw_plus_d = cw[i] + delta_crs;
> +            if (cw_plus_d < (org_cw >> 3) || cw_plus_d > ((org_cw << 3) -
> 1))
> +                return AVERROR_INVALIDDATA;
>              inv_scale_coeff[i] = org_cw * (1 << 11) / cw[i];
> -            lmcs->chroma_scale_coeff[i] = org_cw * (1 << 11) / (cw[i] +
> delta_crs);
> +            lmcs->chroma_scale_coeff[i] = org_cw * (1 << 11) / cw_plus_d;
>          }
>      }
>
> --
> 2.47.0
>
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".