[FFmpeg-devel] [PATCH 2/2] avcodec/cbs_h266_syntax_template: Check num_multi_layer_olss

[Nuo Mi]

On Tue, Sep 5, 2023 at 10:04 AM Michael Niedermayer <michael at niedermayer.cc>
wrote:

> The constraints in the specification are self contradictionary if
> num_multi_layer_olss is 0
>

Hi Michael,
See
https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/cbs_h266_syntax_template.c#L897
This loop can make sure num_multi_layer_olss > 0. The only exception
is vps_ols_mode_idc == 3.
which is reserved by future extension.

Did you see the "ols_mode_idc == 3, patch welcome" output?
Maybe we can return an error at that place.

That is they require various variables to be positive and smaller than 0. So
> num_multi_layer_olss cannot be 0 if vps_each_layer_is_an_ols_flag is 0
>
> Its quite possible a broader check can be used, this is just the first
> condition that I saw violated
>
> Fixes: index 257 out of bounds for type 'uint8_t [257]'
> Fixes:
> 61160/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_METADATA_fuzzer-6709397181825024


> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by
> <https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by>:
> Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/cbs_h266_syntax_template.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/libavcodec/cbs_h266_syntax_template.c
> b/libavcodec/cbs_h266_syntax_template.c
> index 4075897b9a..31b9d0b030 100644
> --- a/libavcodec/cbs_h266_syntax_template.c
> +++ b/libavcodec/cbs_h266_syntax_template.c
> @@ -944,6 +944,10 @@ static int FUNC(vps) (CodedBitstreamContext *ctx,
> RWContext *rw,
>
>      if (!current->vps_each_layer_is_an_ols_flag) {
>          uint16_t vps_num_dpb_params;
> +
> +        if (num_multi_layer_olss <= 0)
> +            return AVERROR_INVALIDDATA;
> +
>          ue(vps_num_dpb_params_minus1, 0, num_multi_layer_olss - 1);
>          if (current->vps_each_layer_is_an_ols_flag)
>              vps_num_dpb_params = 0;
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".
>