[FFmpeg-devel] [PATCH 2/2] avcodec/cbs_h266_syntax_template: Check num_multi_layer_olss

[Michael Niedermayer]

The constraints in the specification are self contradictionary if num_multi_layer_olss is 0
That is they require various variables to be positive and smaller than 0. So
num_multi_layer_olss cannot be 0 if vps_each_layer_is_an_ols_flag is 0

Its quite possible a broader check can be used, this is just the first
condition that I saw violated

Fixes: index 257 out of bounds for type 'uint8_t [257]'
Fixes: 61160/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_METADATA_fuzzer-6709397181825024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/cbs_h266_syntax_template.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c
index 4075897b9a..31b9d0b030 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -944,6 +944,10 @@ static int FUNC(vps) (CodedBitstreamContext *ctx, RWContext *rw,
 
     if (!current->vps_each_layer_is_an_ols_flag) {
         uint16_t vps_num_dpb_params;
+
+        if (num_multi_layer_olss <= 0)
+            return AVERROR_INVALIDDATA;
+
         ue(vps_num_dpb_params_minus1, 0, num_multi_layer_olss - 1);
         if (current->vps_each_layer_is_an_ols_flag)
             vps_num_dpb_params = 0;
-- 
2.17.1