Re: [FFmpeg-devel] [PATCH 2/2] avcodec/cbs_h266_syntax_template: Check num_multi_layer_olss

From: Nuo Mi <nuomi2021@gmail.com>
To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Subject: Re: [FFmpeg-devel] [PATCH 2/2] avcodec/cbs_h266_syntax_template: Check num_multi_layer_olss
Date: Tue, 5 Sep 2023 22:51:23 +0800
Message-ID: <CAFXK13dxoDLYKQhqu7g-rSjR-b1tmioHRAqpBeH_biATDwPdvg@mail.gmail.com> (raw)
In-Reply-To: <20230905020358.32527-2-michael@niedermayer.cc>

On Tue, Sep 5, 2023 at 10:04 AM Michael Niedermayer <michael@niedermayer.cc>
wrote:

> The constraints in the specification are self contradictionary if
> num_multi_layer_olss is 0
>

Hi Michael,
See
https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/cbs_h266_syntax_template.c#L897
This loop can make sure num_multi_layer_olss > 0. The only exception
is vps_ols_mode_idc == 3.
which is reserved by future extension.

Did you see the "ols_mode_idc == 3, patch welcome" output?
Maybe we can return an error at that place.

That is they require various variables to be positive and smaller than 0. So
> num_multi_layer_olss cannot be 0 if vps_each_layer_is_an_ols_flag is 0
>
> Its quite possible a broader check can be used, this is just the first
> condition that I saw violated
>
> Fixes: index 257 out of bounds for type 'uint8_t [257]'
> Fixes:
> 61160/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_METADATA_fuzzer-6709397181825024

> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by
> <https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by>:
> Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/cbs_h266_syntax_template.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/libavcodec/cbs_h266_syntax_template.c
> b/libavcodec/cbs_h266_syntax_template.c
> index 4075897b9a..31b9d0b030 100644
> --- a/libavcodec/cbs_h266_syntax_template.c
> +++ b/libavcodec/cbs_h266_syntax_template.c
> @@ -944,6 +944,10 @@ static int FUNC(vps) (CodedBitstreamContext *ctx,
> RWContext *rw,
>
>      if (!current->vps_each_layer_is_an_ols_flag) {
>          uint16_t vps_num_dpb_params;
> +
> +        if (num_multi_layer_olss <= 0)
> +            return AVERROR_INVALIDDATA;
> +
>          ue(vps_num_dpb_params_minus1, 0, num_multi_layer_olss - 1);
>          if (current->vps_each_layer_is_an_ols_flag)
>              vps_num_dpb_params = 0;
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".