[FFmpeg-devel] [PATCH] lavc/vvc: Validate alf_list indexes

[post at frankplowman.com]

From: Frank Plowman <post at frankplowman.com>

Fixes crashes when decoding illegal bitstreams found by fuzzing.

Signed-off-by: Frank Plowman <post at frankplowman.com>
---
 libavcodec/vvc/vvc_ctu.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/libavcodec/vvc/vvc_ctu.c b/libavcodec/vvc/vvc_ctu.c
index d166b16a19..f601c6c95e 100644
--- a/libavcodec/vvc/vvc_ctu.c
+++ b/libavcodec/vvc/vvc_ctu.c
@@ -2207,7 +2207,7 @@ static void hls_sao(VVCLocalContext *lc, const int rx, const int ry)
     }
 }
 
-static void alf_params(VVCLocalContext *lc, const int rx, const int ry)
+static int alf_params(VVCLocalContext *lc, const int rx, const int ry)
 {
     const VVCFrameContext *fc     = lc->fc;
     const H266RawSliceHeader *sh  = lc->sc->sh.r;
@@ -2233,6 +2233,11 @@ static void alf_params(VVCLocalContext *lc, const int rx, const int ry)
                 c_idx == CB ? sh->sh_alf_cb_enabled_flag : sh->sh_alf_cr_enabled_flag;
             if (alf_enabled_flag) {
                 const VVCALF *aps = fc->ps.alf_list[sh->sh_alf_aps_id_chroma];
+                if (!aps) {
+                    // Slice header refers to an APS which does not exist
+                    return AVERROR_INVALIDDATA;
+                }
+
                 alf->ctb_flag[c_idx] = ff_vvc_alf_ctb_flag(lc, rx, ry, c_idx);
                 alf->alf_ctb_filter_alt_idx[c_idx - 1] = 0;
                 if (alf->ctb_flag[c_idx] && aps->num_chroma_filters > 1)
@@ -2247,10 +2252,16 @@ static void alf_params(VVCLocalContext *lc, const int rx, const int ry)
             alf->ctb_cc_idc[i] = 0;
             if (cc_enabled[i]) {
                 const VVCALF *aps = fc->ps.alf_list[cc_aps_id[i]];
+                if (!aps) {
+                    // Slice header refers to an APS which does not exist
+                    return AVERROR_INVALIDDATA;
+                }
                 alf->ctb_cc_idc[i] = ff_vvc_alf_ctb_cc_idc(lc, rx, ry, i, aps->num_cc_filters[i]);
             }
         }
     }
+
+    return 0;
 }
 
 static void deblock_params(VVCLocalContext *lc, const int rx, const int ry)
@@ -2274,7 +2285,9 @@ static int hls_coding_tree_unit(VVCLocalContext *lc,
     memset(lc->parse.chroma_qp_offset, 0, sizeof(lc->parse.chroma_qp_offset));
 
     hls_sao(lc, x0 >> sps->ctb_log2_size_y, y0 >> sps->ctb_log2_size_y);
-    alf_params(lc, x0 >> sps->ctb_log2_size_y, y0 >> sps->ctb_log2_size_y);
+    ret = alf_params(lc, x0 >> sps->ctb_log2_size_y, y0 >> sps->ctb_log2_size_y);
+    if (ret < 0)
+        return ret;
     deblock_params(lc, x0 >> sps->ctb_log2_size_y, y0 >> sps->ctb_log2_size_y);
 
     if (IS_I(rsh) && sps->r->sps_qtbtt_dual_tree_intra_flag)
-- 
2.43.0