[FFmpeg-devel] [PATCH 2/2] avcodec/cbs_h266_syntax_template: Check num_multi_layer_olss

[Michael Niedermayer]

On Tue, Sep 05, 2023 at 10:51:23PM +0800, Nuo Mi wrote:
> On Tue, Sep 5, 2023 at 10:04 AM Michael Niedermayer <michael at niedermayer.cc>
> wrote:
> 
> > The constraints in the specification are self contradictionary if
> > num_multi_layer_olss is 0
> >
> 
> Hi Michael,
> See
> https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/cbs_h266_syntax_template.c#L897
> This loop can make sure num_multi_layer_olss > 0. The only exception
> is vps_ols_mode_idc == 3.
> which is reserved by future extension.
> 
> Did you see the "ols_mode_idc == 3, patch welcome" output?
> Maybe we can return an error at that place.

ols_mode_idc and vps_ols_mode_idc are 2


> 
> That is they require various variables to be positive and smaller than 0. So
> > num_multi_layer_olss cannot be 0 if vps_each_layer_is_an_ols_flag is 0
> >
> > Its quite possible a broader check can be used, this is just the first
> > condition that I saw violated
> >
> > Fixes: index 257 out of bounds for type 'uint8_t [257]'
> > Fixes:
> > 61160/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_METADATA_fuzzer-6709397181825024
> 
> 
> > Found-by: continuous fuzzing process
> > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by
> > <https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by>:
> > Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >  libavcodec/cbs_h266_syntax_template.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/libavcodec/cbs_h266_syntax_template.c
> > b/libavcodec/cbs_h266_syntax_template.c
> > index 4075897b9a..31b9d0b030 100644
> > --- a/libavcodec/cbs_h266_syntax_template.c
> > +++ b/libavcodec/cbs_h266_syntax_template.c
> > @@ -944,6 +944,10 @@ static int FUNC(vps) (CodedBitstreamContext *ctx,
> > RWContext *rw,
> >
> >      if (!current->vps_each_layer_is_an_ols_flag) {
> >          uint16_t vps_num_dpb_params;
> > +
> > +        if (num_multi_layer_olss <= 0)
> > +            return AVERROR_INVALIDDATA;
> > +
> >          ue(vps_num_dpb_params_minus1, 0, num_multi_layer_olss - 1);
> >          if (current->vps_each_layer_is_an_ols_flag)
> >              vps_num_dpb_params = 0;
> > --
> > 2.17.1
> >
> > _______________________________________________
> > ffmpeg-devel mailing list
> > ffmpeg-devel at ffmpeg.org
> > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> >
> > To unsubscribe, visit link above, or email
> > ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".
> >
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Into a blind darkness they enter who follow after the Ignorance,
they as if into a greater darkness enter who devote themselves
to the Knowledge alone. -- Isha Upanishad
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20230906/b8de2f34/attachment.sig>