[FFmpeg-devel] [PATCH 00/14] avcodec/vvcdec: support subpicture

[Frank Plowman]

On 18/03/2024 14:16, Nuo Mi wrote:
> see introductions here: https://dashif.org/docs/VVC%20HLS%20overview%20.pdf
> 
> Frank Plowman (1):
>   avcodec/vvcdec: support rectangular single-slice subpics
> 
> Nuo Mi (13):
>   avcodec/vvcdec: NoBackwardPredFlag, only check active pictures
>   avcodec/cbs_h266: fix sh_collocated_from_l0_flag and
>     sh_collocated_ref_idx infer
>   avcodec/vvcdec: derive subpic postion for PPS
>   avcodec/vvcdec: ff_vvc_decode_neighbour, support subpicture
>   avcodec/vvcdec: misc, rename x_ctb, y_ctb, ctu_x, ctu_y to rx, ry to
>     avoid misleading
>   avcodec/vvcdec: refact out deblock_is_boundary
>   avcodec/vvcdec: deblock, support subpicture
>   avcodec/vvcdec: refact, movie the lc->sc assignment to task_run_stage
>     to simplify the code
>   avcodec/vvcdec: sao, refact out tile_edge arrays
>   avcodec/vvcdec: sao, support subpicture
>   avcodec/vvcdec: alf, support subpicture
>   avcodec/vvcdec: mvs, support subpicture
>   avcodec/vvcdec: inter prediction, support subpicture
> 
>  libavcodec/cbs_h266_syntax_template.c |  37 ++--
>  libavcodec/vvc/vvc_ctu.c              |  12 +-
>  libavcodec/vvc/vvc_ctu.h              |   6 +-
>  libavcodec/vvc/vvc_filter.c           | 233 +++++++++++++-------------
>  libavcodec/vvc/vvc_filter.h           |   6 +-
>  libavcodec/vvc/vvc_inter.c            |  79 ++++++---
>  libavcodec/vvc/vvc_mvs.c              |  35 ++--
>  libavcodec/vvc/vvc_ps.c               | 150 ++++++++++++++---
>  libavcodec/vvc/vvc_ps.h               |   4 +
>  libavcodec/vvc/vvc_thread.c           |  66 ++------
>  10 files changed, 384 insertions(+), 244 deletions(-)
> 
> --
> 2.25.1

Thank you.

When compiled without a sanitizer, all subpicture conformance bitstreams
decode correctly, however when compiled with UBSAN/ASAN this set causes
a lot of errors for me.

With UBSAN, I get errors similar to:

libavcodec/vvc/vvc_ctu.c:1553:13: runtime error: member access within
misaligned address 0xffffb52dbd6c for type 'av_alias64', which requires
8 byte alignment
0xffffb52dbd6c: note: pointer points here
  f0 b3 9a 99 ff ff 00 00  00 be 2d b5 ff ff 00 00  c4 a6 fb d5 aa aa 00
00  c0 f8 2d b5 ff ff 00 00

on the following sequences:
* SUBPIC_B_HUAWEI
* SUBPIC_C_ERICSSON
* SUBPIC_E_MediaTek
* LMCS_B_Dolby
* CodingTools_E_Tencent

With ASAN, I get errors similar to:

=================================================================
==67289==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60300000067a at pc 0xaaaad00d21a0 bp 0xfffffba438f0 sp 0xfffffba43908
READ of size 2 at 0x60300000067a thread T0
    #0 0xaaaad00d219c in subpic_tiles
/home/frank/FFmpeg/libavcodec/vvc/vvc_ps.c:374:12
    #1 0xaaaad00d1048 in pps_subpic_slice
/home/frank/FFmpeg/libavcodec/vvc/vvc_ps.c:406:5
    #2 0xaaaad00cf2cc in pps_single_slice_per_subpic
/home/frank/FFmpeg/libavcodec/vvc/vvc_ps.c:419:13
    #3 0xaaaad00ce8e0 in pps_rect_slice
/home/frank/FFmpeg/libavcodec/vvc/vvc_ps.c:464:9
    #4 0xaaaad00cd4f8 in pps_slice_map
/home/frank/FFmpeg/libavcodec/vvc/vvc_ps.c:499:9
    #5 0xaaaad00caf64 in pps_derive
/home/frank/FFmpeg/libavcodec/vvc/vvc_ps.c:543:11
    #6 0xaaaad00cac00 in pps_alloc
/home/frank/FFmpeg/libavcodec/vvc/vvc_ps.c:576:11
    #7 0xaaaad00c64f8 in decode_pps
/home/frank/FFmpeg/libavcodec/vvc/vvc_ps.c:598:11
    #8 0xaaaad00c4444 in decode_ps
/home/frank/FFmpeg/libavcodec/vvc/vvc_ps.c:630:11
    #9 0xaaaad00c3e70 in ff_vvc_decode_frame_ps
/home/frank/FFmpeg/libavcodec/vvc/vvc_ps.c:866:11
...

0x60300000067a is located 0 bytes after 10-byte region
[0x603000000670,0x60300000067a)

on the following sequences:
* SUBPIC_C_ERICSSON
* SUBPIC_D_ERICSSON

Note SUBPIC_D_ERICSSON has the ASAN error but no UBSAN error.

Cheers,
Frank