[FFmpeg-devel] Re: [PATCH] avcodec/vvc: validate reference picture list indices

[Christophe Gisquet via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

Hi,

sorry in advance for any bad formatting in my reply from a phone.

Le mar. 6 janv. 2026, 03:13, 0xBat via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>
a écrit

> ---
>  libavcodec/vvc/ctu.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c
> index 18cbe0fe0f..8e4f003886 100644
> --- a/libavcodec/vvc/ctu.c
> +++ b/libavcodec/vvc/ctu.c
> @@ -1287,6 +1287,8 @@ static void derive_mmvd(const VVCLocalContext *lc,
> MvField *mvf, const Mv *mmvd_
>      if (mvf->pred_flag == PF_BI) {
>          const RefPicList *rpl = sc->rpl;
>          const int poc = lc->fc->ps.ph.poc;
> +        if (mvf->ref_idx[L0] >= rpl[L0].nb_refs || mvf->ref_idx[L1] >=
> rpl[L1].nb_refs)
> +            return;
>          const int diff[] = {
>              poc - rpl[L0].refs[mvf->ref_idx[L0]].poc,
>

Not a maintainer or contributor to the VVC decoder, but sounds fishy. That
a ref_idx is invalid, means that wherever it came from didn't validate
against the RPL. I don't know where mvf comes from, but if that's from the
current frame, it is extremely weird.

And by that I mean, the issue sounds like it should be caught earlier to
avoid it from propagating to other places.

Regards,
Christophe

> Christophe
_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org