[FFmpeg-devel] Re: [PATCH] avcodec/vvc: add boundary checks for CTU table access

[Christophe Gisquet via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

Hi,

Le mar. 6 janv. 2026, 03:13, 0xBat via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>
a écrit :

> In libavcodec/vvc/ctu.c, the functions set_tb_size and set_cb_pos lack
> proper boundary checks before performing memset operations. This patch adds
> validation against PPS dimensions to prevent heap overflows.
>
> Signed-off-by: 0xBat <monsterbat02@gmail.com>
> ---
>  libavcodec/vvc/ctu.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c
> index 18cbe0fe0f..ce8a7ab90e 100644
> --- a/libavcodec/vvc/ctu.c
> +++ b/libavcodec/vvc/ctu.c
> @@ -52,6 +52,9 @@ static void set_tb_size(const VVCFrameContext *fc, const
> TransformBlock *tb)
>
>      for (int y = y_tb; y < end; y++) {
>          const int off = y * fc->ps.pps->min_tu_width + x_tb;
> +        int max_off = fc->ps.pps->min_tu_width *
> fc->ps.pps->min_tu_height;
> +        if (off + width > max_off)
> +            return;
>          memset(fc->tab.tb_width [is_chroma] + off, tb->tb_width,  width);
>          memset(fc->tab.tb_height[is_chroma] + off, tb->tb_height, width);
>      }
> @@ -1185,6 +1188,8 @@ static void set_cb_pos(const VVCFrameContext *fc,
> const CodingUnit *cu)
>              fc->tab.cb_pos_x[ch_type][x + i] = cu->x0;
>              fc->tab.cb_pos_y[ch_type][x + i] = cu->y0;
>          }
> +        if (x + width > fc->ps.pps->min_tu_width *
> fc->ps.pps->min_tu_height)
> +            return;
>          memset(&fc->tab.cb_width[ch_type][x], cu->cb_width, width);
>          memset(&fc->tab.cb_height[ch_type][x], cu->cb_height, width);
>          memset(&fc->tab.cqt_depth[ch_type][x], cu->cqt_depth, width);
>

So lines that are processed are ok if overflowing. It sounds like width
should be clipped if that's an expected behaviour, or width is incorrect to
being with?

This is a question probably more for the maintainers/contributors.

Regards,
Christophe

>
_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org