* [FFmpeg-devel] [PATCH v1] lavc/vvc: Validate num_signalled_palette_entries
@ 2025-05-17 21:03 Frank Plowman
2025-05-18 1:42 ` Nuo Mi
0 siblings, 1 reply; 4+ messages in thread
From: Frank Plowman @ 2025-05-17 21:03 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Frank Plowman, nuomi2021, toqsxw
"The value of CurrentPaletteSize[ startComp ] shall be in the range of 0
to maxNumPaletteEntries, inclusive."
Signed-off-by: Frank Plowman <post@frankplowman.com>
---
libavcodec/vvc/ctu.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c
index 62c9d4f5c0..70800ba5fa 100644
--- a/libavcodec/vvc/ctu.c
+++ b/libavcodec/vvc/ctu.c
@@ -20,6 +20,7 @@
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
+#include "libavutil/error.h"
#include "libavutil/refstruct.h"
#include "cabac.h"
@@ -1873,7 +1874,7 @@ static void palette_predicted(VVCLocalContext *lc, const bool local_dual_tree, i
cu->plt[c].size = nb_predicted;
}
-static void palette_signaled(VVCLocalContext *lc, const bool local_dual_tree,
+static int palette_signaled(VVCLocalContext *lc, const bool local_dual_tree,
const int start, const int end, const int max_entries)
{
const VVCSPS *sps = lc->fc->ps.sps;
@@ -1883,6 +1884,9 @@ static void palette_signaled(VVCLocalContext *lc, const bool local_dual_tree,
const int size = nb_predicted + nb_signaled;
const bool dual_tree_luma = local_dual_tree && cu->tree_type == DUAL_TREE_LUMA;
+ if (size > max_entries)
+ return AVERROR_INVALIDDATA;
+
for (int c = start; c < end; c++) {
Palette *plt = cu->plt + c;
for (int i = nb_predicted; i < size; i++) {
@@ -1894,6 +1898,8 @@ static void palette_signaled(VVCLocalContext *lc, const bool local_dual_tree,
}
plt->size = size;
}
+
+ return 0;
}
static void palette_update_predictor(VVCLocalContext *lc, const bool local_dual_tree, int start, int end,
@@ -2070,7 +2076,7 @@ static int hls_palette_coding(VVCLocalContext *lc, const VVCTreeType tree_type)
int max_index = 0;
int prev_run_pos = 0;
- int predictor_size, start, end;
+ int predictor_size, start, end, ret;
bool reused[VVC_MAX_NUM_PALETTE_PREDICTOR_SIZE];
uint8_t run_type[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE];
uint8_t index[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE];
@@ -2083,7 +2089,9 @@ static int hls_palette_coding(VVCLocalContext *lc, const VVCTreeType tree_type)
predictor_size = pp[start].size;
memset(reused, 0, sizeof(reused[0]) * predictor_size);
palette_predicted(lc, local_dual_tree, start, end, reused, predictor_size, max_entries);
- palette_signaled(lc, local_dual_tree, start, end, max_entries);
+ ret = palette_signaled(lc, local_dual_tree, start, end, max_entries);
+ if (ret < 0)
+ return ret;
palette_update_predictor(lc, local_dual_tree, start, end, reused, predictor_size);
if (cu->plt[start].size > 0)
--
2.47.0
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [FFmpeg-devel] [PATCH v1] lavc/vvc: Validate num_signalled_palette_entries
2025-05-17 21:03 [FFmpeg-devel] [PATCH v1] lavc/vvc: Validate num_signalled_palette_entries Frank Plowman
@ 2025-05-18 1:42 ` Nuo Mi
2025-05-18 6:51 ` Frank Plowman
0 siblings, 1 reply; 4+ messages in thread
From: Nuo Mi @ 2025-05-18 1:42 UTC (permalink / raw)
To: Frank Plowman; +Cc: toqsxw, ffmpeg-devel
Hi Frank,
👍,your fuzzing infrastructure caught this issue as well.
How about this:
https://patchwork.ffmpeg.org/project/ffmpeg/patch/20250517055150.807683-1-nuomi2021@gmail.com/
On Sun, May 18, 2025 at 5:05 AM Frank Plowman <post@frankplowman.com> wrote:
> "The value of CurrentPaletteSize[ startComp ] shall be in the range of 0
> to maxNumPaletteEntries, inclusive."
>
> Signed-off-by: Frank Plowman <post@frankplowman.com>
> ---
> libavcodec/vvc/ctu.c | 14 +++++++++++---
> 1 file changed, 11 insertions(+), 3 deletions(-)
>
> diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c
> index 62c9d4f5c0..70800ba5fa 100644
> --- a/libavcodec/vvc/ctu.c
> +++ b/libavcodec/vvc/ctu.c
> @@ -20,6 +20,7 @@
> * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
> 02110-1301 USA
> */
>
> +#include "libavutil/error.h"
> #include "libavutil/refstruct.h"
>
> #include "cabac.h"
> @@ -1873,7 +1874,7 @@ static void palette_predicted(VVCLocalContext *lc,
> const bool local_dual_tree, i
> cu->plt[c].size = nb_predicted;
> }
>
> -static void palette_signaled(VVCLocalContext *lc, const bool
> local_dual_tree,
> +static int palette_signaled(VVCLocalContext *lc, const bool
> local_dual_tree,
> const int start, const int end, const int max_entries)
> {
> const VVCSPS *sps = lc->fc->ps.sps;
> @@ -1883,6 +1884,9 @@ static void palette_signaled(VVCLocalContext *lc,
> const bool local_dual_tree,
> const int size = nb_predicted + nb_signaled;
> const bool dual_tree_luma = local_dual_tree && cu->tree_type ==
> DUAL_TREE_LUMA;
>
> + if (size > max_entries)
> + return AVERROR_INVALIDDATA;
> +
> for (int c = start; c < end; c++) {
> Palette *plt = cu->plt + c;
> for (int i = nb_predicted; i < size; i++) {
> @@ -1894,6 +1898,8 @@ static void palette_signaled(VVCLocalContext *lc,
> const bool local_dual_tree,
> }
> plt->size = size;
> }
> +
> + return 0;
> }
>
> static void palette_update_predictor(VVCLocalContext *lc, const bool
> local_dual_tree, int start, int end,
> @@ -2070,7 +2076,7 @@ static int hls_palette_coding(VVCLocalContext *lc,
> const VVCTreeType tree_type)
> int max_index = 0;
> int prev_run_pos = 0;
>
> - int predictor_size, start, end;
> + int predictor_size, start, end, ret;
> bool reused[VVC_MAX_NUM_PALETTE_PREDICTOR_SIZE];
> uint8_t run_type[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE];
> uint8_t index[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE];
> @@ -2083,7 +2089,9 @@ static int hls_palette_coding(VVCLocalContext *lc,
> const VVCTreeType tree_type)
> predictor_size = pp[start].size;
> memset(reused, 0, sizeof(reused[0]) * predictor_size);
> palette_predicted(lc, local_dual_tree, start, end, reused,
> predictor_size, max_entries);
> - palette_signaled(lc, local_dual_tree, start, end, max_entries);
> + ret = palette_signaled(lc, local_dual_tree, start, end, max_entries);
> + if (ret < 0)
> + return ret;
> palette_update_predictor(lc, local_dual_tree, start, end, reused,
> predictor_size);
>
> if (cu->plt[start].size > 0)
> --
> 2.47.0
>
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [FFmpeg-devel] [PATCH v1] lavc/vvc: Validate num_signalled_palette_entries
2025-05-18 1:42 ` Nuo Mi
@ 2025-05-18 6:51 ` Frank Plowman
2025-05-19 11:50 ` Nuo Mi
0 siblings, 1 reply; 4+ messages in thread
From: Frank Plowman @ 2025-05-18 6:51 UTC (permalink / raw)
To: ffmpeg-devel
On 18/05/2025 02:42, Nuo Mi wrote:
> Hi Frank,
> 👍,your fuzzing infrastructure caught this issue as well.
> How about this:
> https://patchwork.ffmpeg.org/project/ffmpeg/patch/20250517055150.807683-1-nuomi2021@gmail.com/
Sorry, I missed this. Your patch looks good to me: probably preferable
in that it also validates the predicted size by the looks of it
(although I don't have a stream which exercises this aspect).
>
> On Sun, May 18, 2025 at 5:05 AM Frank Plowman <post@frankplowman.com> wrote:
>
>> "The value of CurrentPaletteSize[ startComp ] shall be in the range of 0
>> to maxNumPaletteEntries, inclusive."
>>
>> Signed-off-by: Frank Plowman <post@frankplowman.com>
>> ---
>> libavcodec/vvc/ctu.c | 14 +++++++++++---
>> 1 file changed, 11 insertions(+), 3 deletions(-)
>>
>> diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c
>> index 62c9d4f5c0..70800ba5fa 100644
>> --- a/libavcodec/vvc/ctu.c
>> +++ b/libavcodec/vvc/ctu.c
>> @@ -20,6 +20,7 @@
>> * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
>> 02110-1301 USA
>> */
>>
>> +#include "libavutil/error.h"
>> #include "libavutil/refstruct.h"
>>
>> #include "cabac.h"
>> @@ -1873,7 +1874,7 @@ static void palette_predicted(VVCLocalContext *lc,
>> const bool local_dual_tree, i
>> cu->plt[c].size = nb_predicted;
>> }
>>
>> -static void palette_signaled(VVCLocalContext *lc, const bool
>> local_dual_tree,
>> +static int palette_signaled(VVCLocalContext *lc, const bool
>> local_dual_tree,
>> const int start, const int end, const int max_entries)
>> {
>> const VVCSPS *sps = lc->fc->ps.sps;
>> @@ -1883,6 +1884,9 @@ static void palette_signaled(VVCLocalContext *lc,
>> const bool local_dual_tree,
>> const int size = nb_predicted + nb_signaled;
>> const bool dual_tree_luma = local_dual_tree && cu->tree_type ==
>> DUAL_TREE_LUMA;
>>
>> + if (size > max_entries)
>> + return AVERROR_INVALIDDATA;
>> +
>> for (int c = start; c < end; c++) {
>> Palette *plt = cu->plt + c;
>> for (int i = nb_predicted; i < size; i++) {
>> @@ -1894,6 +1898,8 @@ static void palette_signaled(VVCLocalContext *lc,
>> const bool local_dual_tree,
>> }
>> plt->size = size;
>> }
>> +
>> + return 0;
>> }
>>
>> static void palette_update_predictor(VVCLocalContext *lc, const bool
>> local_dual_tree, int start, int end,
>> @@ -2070,7 +2076,7 @@ static int hls_palette_coding(VVCLocalContext *lc,
>> const VVCTreeType tree_type)
>> int max_index = 0;
>> int prev_run_pos = 0;
>>
>> - int predictor_size, start, end;
>> + int predictor_size, start, end, ret;
>> bool reused[VVC_MAX_NUM_PALETTE_PREDICTOR_SIZE];
>> uint8_t run_type[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE];
>> uint8_t index[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE];
>> @@ -2083,7 +2089,9 @@ static int hls_palette_coding(VVCLocalContext *lc,
>> const VVCTreeType tree_type)
>> predictor_size = pp[start].size;
>> memset(reused, 0, sizeof(reused[0]) * predictor_size);
>> palette_predicted(lc, local_dual_tree, start, end, reused,
>> predictor_size, max_entries);
>> - palette_signaled(lc, local_dual_tree, start, end, max_entries);
>> + ret = palette_signaled(lc, local_dual_tree, start, end, max_entries);
>> + if (ret < 0)
>> + return ret;
>> palette_update_predictor(lc, local_dual_tree, start, end, reused,
>> predictor_size);
>>
>> if (cu->plt[start].size > 0)
>> --
>> 2.47.0
>>
>>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [FFmpeg-devel] [PATCH v1] lavc/vvc: Validate num_signalled_palette_entries
2025-05-18 6:51 ` Frank Plowman
@ 2025-05-19 11:50 ` Nuo Mi
0 siblings, 0 replies; 4+ messages in thread
From: Nuo Mi @ 2025-05-19 11:50 UTC (permalink / raw)
To: FFmpeg development discussions and patches
On Sun, May 18, 2025 at 2:51 PM Frank Plowman <post@frankplowman.com> wrote:
> On 18/05/2025 02:42, Nuo Mi wrote:
> > Hi Frank,
> > 👍,your fuzzing infrastructure caught this issue as well.
> > How about this:
> >
> https://patchwork.ffmpeg.org/project/ffmpeg/patch/20250517055150.807683-1-nuomi2021@gmail.com/
>
> Sorry, I missed this. Your patch looks good to me: probably preferable
> in that it also validates the predicted size by the looks of it
> (although I don't have a stream which exercises this aspect).
>
Hi Frank,
Not needed — we get predictor_size from lc->ep->pp[c].size.
lc->ep->pp[i].size is protected by max_predictor, which is smaller than
VVC_MAX_NUM_PALETTE_PREDICTOR_SIZE.
>
> >
> > On Sun, May 18, 2025 at 5:05 AM Frank Plowman <post@frankplowman.com>
> wrote:
> >
> >> "The value of CurrentPaletteSize[ startComp ] shall be in the range of 0
> >> to maxNumPaletteEntries, inclusive."
> >>
> >> Signed-off-by: Frank Plowman <post@frankplowman.com>
> >> ---
> >> libavcodec/vvc/ctu.c | 14 +++++++++++---
> >> 1 file changed, 11 insertions(+), 3 deletions(-)
> >>
> >> diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c
> >> index 62c9d4f5c0..70800ba5fa 100644
> >> --- a/libavcodec/vvc/ctu.c
> >> +++ b/libavcodec/vvc/ctu.c
> >> @@ -20,6 +20,7 @@
> >> * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
> >> 02110-1301 USA
> >> */
> >>
> >> +#include "libavutil/error.h"
> >> #include "libavutil/refstruct.h"
> >>
> >> #include "cabac.h"
> >> @@ -1873,7 +1874,7 @@ static void palette_predicted(VVCLocalContext *lc,
> >> const bool local_dual_tree, i
> >> cu->plt[c].size = nb_predicted;
> >> }
> >>
> >> -static void palette_signaled(VVCLocalContext *lc, const bool
> >> local_dual_tree,
> >> +static int palette_signaled(VVCLocalContext *lc, const bool
> >> local_dual_tree,
> >> const int start, const int end, const int max_entries)
> >> {
> >> const VVCSPS *sps = lc->fc->ps.sps;
> >> @@ -1883,6 +1884,9 @@ static void palette_signaled(VVCLocalContext *lc,
> >> const bool local_dual_tree,
> >> const int size = nb_predicted + nb_signaled;
> >> const bool dual_tree_luma = local_dual_tree && cu->tree_type ==
> >> DUAL_TREE_LUMA;
> >>
> >> + if (size > max_entries)
> >> + return AVERROR_INVALIDDATA;
> >> +
> >> for (int c = start; c < end; c++) {
> >> Palette *plt = cu->plt + c;
> >> for (int i = nb_predicted; i < size; i++) {
> >> @@ -1894,6 +1898,8 @@ static void palette_signaled(VVCLocalContext *lc,
> >> const bool local_dual_tree,
> >> }
> >> plt->size = size;
> >> }
> >> +
> >> + return 0;
> >> }
> >>
> >> static void palette_update_predictor(VVCLocalContext *lc, const bool
> >> local_dual_tree, int start, int end,
> >> @@ -2070,7 +2076,7 @@ static int hls_palette_coding(VVCLocalContext *lc,
> >> const VVCTreeType tree_type)
> >> int max_index = 0;
> >> int prev_run_pos = 0;
> >>
> >> - int predictor_size, start, end;
> >> + int predictor_size, start, end, ret;
> >> bool reused[VVC_MAX_NUM_PALETTE_PREDICTOR_SIZE];
> >> uint8_t run_type[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE];
> >> uint8_t index[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE];
> >> @@ -2083,7 +2089,9 @@ static int hls_palette_coding(VVCLocalContext *lc,
> >> const VVCTreeType tree_type)
> >> predictor_size = pp[start].size;
> >> memset(reused, 0, sizeof(reused[0]) * predictor_size);
> >> palette_predicted(lc, local_dual_tree, start, end, reused,
> >> predictor_size, max_entries);
> >> - palette_signaled(lc, local_dual_tree, start, end, max_entries);
> >> + ret = palette_signaled(lc, local_dual_tree, start, end,
> max_entries);
> >> + if (ret < 0)
> >> + return ret;
> >> palette_update_predictor(lc, local_dual_tree, start, end, reused,
> >> predictor_size);
> >>
> >> if (cu->plt[start].size > 0)
> >> --
> >> 2.47.0
> >>
> >>
> > _______________________________________________
> > ffmpeg-devel mailing list
> > ffmpeg-devel@ffmpeg.org
> > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> >
> > To unsubscribe, visit link above, or email
> > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-05-19 11:50 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-05-17 21:03 [FFmpeg-devel] [PATCH v1] lavc/vvc: Validate num_signalled_palette_entries Frank Plowman
2025-05-18 1:42 ` Nuo Mi
2025-05-18 6:51 ` Frank Plowman
2025-05-19 11:50 ` Nuo Mi
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git