[FFmpeg-devel] [PATCH 2/3] avcodec/cbs_h266_syntax_template: sanity check num_multi_layer_olss

[Michael Niedermayer]

It is not possible to encode a index into an empty list. Thus
this must be invalid at this point or before.
Its likely a broader earlier check can be used here, someone knowing
VVC should look at that. Its not immedeatly obvious from the spec
by looking for numlayerolss

Fixes: out of array access
Fixes: 65160/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_METADATA_fuzzer-4665241535119360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/cbs_h266_syntax_template.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c
index 549d0212119..9e479c9c314 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -946,6 +946,8 @@ static int FUNC(vps) (CodedBitstreamContext *ctx, RWContext *rw,
 
     if (!current->vps_each_layer_is_an_ols_flag) {
         uint16_t vps_num_dpb_params;
+        if (!num_multi_layer_olss)
+            return AVERROR_INVALIDDATA;
         ue(vps_num_dpb_params_minus1, 0, num_multi_layer_olss - 1);
         if (current->vps_each_layer_is_an_ols_flag)
             vps_num_dpb_params = 0;
-- 
2.17.1