[FFmpeg-devel] [PATCH] avcodec/hevcdec: fix segfault on invalid film grain metadata

[Niklas Haas]

On Sat, 06 Apr 2024 13:14:45 +0200 Niklas Haas <ffmpeg at haasn.xyz> wrote:
> From: Niklas Haas <git at haasn.dev>
> 
> Invalid input files may contain film grain metadata which survives
> ff_h274_film_grain_params_supported() but does not pass
> av_film_grain_params_select(), leading to a SIGSEGV on hevc_frame_end().
> 
> Fix this by duplicating the av_film_grain_params_select() check at frame
> init time.
> 
> An alternative solution here would be to defer the incompatibility check
> to hevc_frame_end(), but this has the downside of allocating a film
> grain buffer even when we already know we can't apply film grain.
> 
> Fixes: https://trac.ffmpeg.org/ticket/10951
> ---
>  libavcodec/hevcdec.c | 15 ++++++++-------
>  1 file changed, 8 insertions(+), 7 deletions(-)
> 
> diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c
> index 727b02f0f40..d3b668af00e 100644
> --- a/libavcodec/hevcdec.c
> +++ b/libavcodec/hevcdec.c
> @@ -2893,10 +2893,15 @@ static int hevc_frame_start(HEVCContext *s)
>          !(s->avctx->export_side_data & AV_CODEC_EXPORT_DATA_FILM_GRAIN) &&
>          !s->avctx->hwaccel;
>  
> +    ret = set_side_data(s);
> +    if (ret < 0)
> +        goto fail;
> +
>      if (s->ref->needs_fg &&
> -        s->sei.common.film_grain_characteristics.present &&
> -        !ff_h274_film_grain_params_supported(s->sei.common.film_grain_characteristics.model_id,
> -                                             s->ref->frame->format)) {
> +        ( s->sei.common.film_grain_characteristics.present &&
> +          !ff_h274_film_grain_params_supported(s->sei.common.film_grain_characteristics.model_id,
> +                                             s->ref->frame->format))
> +          || !av_film_grain_params_select(s->ref->frame)) {
>          av_log_once(s->avctx, AV_LOG_WARNING, AV_LOG_DEBUG, &s->film_grain_warning_shown,
>                      "Unsupported film grain parameters. Ignoring film grain.\n");
>          s->ref->needs_fg = 0;
> @@ -2910,10 +2915,6 @@ static int hevc_frame_start(HEVCContext *s)
>              goto fail;
>      }
>  
> -    ret = set_side_data(s);
> -    if (ret < 0)
> -        goto fail;
> -
>      s->frame->pict_type = 3 - s->sh.slice_type;
>  
>      if (!IS_IRAP(s))
> -- 
> 2.44.0
> 

Will merge very soon if there are no comments, as this fixes a bug
marked important.