[FFmpeg-devel] [PATCH v1] lavc/vvc: Validate num_signalled_palette_entries

[Nuo Mi]

On Sun, May 18, 2025 at 2:51 PM Frank Plowman <post at frankplowman.com> wrote:

> On 18/05/2025 02:42, Nuo Mi wrote:
> > Hi Frank,
> > 👍,your fuzzing infrastructure caught this issue as well.
> > How about this:
> >
> https://patchwork.ffmpeg.org/project/ffmpeg/patch/20250517055150.807683-1-nuomi2021@gmail.com/
>
> Sorry, I missed this.  Your patch looks good to me: probably preferable
> in that it also validates the predicted size by the looks of it
> (although I don't have a stream which exercises this aspect).
>
Hi Frank,
Not needed — we get predictor_size from lc->ep->pp[c].size.
lc->ep->pp[i].size is protected by max_predictor, which is smaller than
VVC_MAX_NUM_PALETTE_PREDICTOR_SIZE.

>
> >
> > On Sun, May 18, 2025 at 5:05 AM Frank Plowman <post at frankplowman.com>
> wrote:
> >
> >> "The value of CurrentPaletteSize[ startComp ] shall be in the range of 0
> >> to maxNumPaletteEntries, inclusive."
> >>
> >> Signed-off-by: Frank Plowman <post at frankplowman.com>
> >> ---
> >>  libavcodec/vvc/ctu.c | 14 +++++++++++---
> >>  1 file changed, 11 insertions(+), 3 deletions(-)
> >>
> >> diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c
> >> index 62c9d4f5c0..70800ba5fa 100644
> >> --- a/libavcodec/vvc/ctu.c
> >> +++ b/libavcodec/vvc/ctu.c
> >> @@ -20,6 +20,7 @@
> >>   * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
> >> 02110-1301 USA
> >>   */
> >>
> >> +#include "libavutil/error.h"
> >>  #include "libavutil/refstruct.h"
> >>
> >>  #include "cabac.h"
> >> @@ -1873,7 +1874,7 @@ static void palette_predicted(VVCLocalContext *lc,
> >> const bool local_dual_tree, i
> >>          cu->plt[c].size = nb_predicted;
> >>  }
> >>
> >> -static void palette_signaled(VVCLocalContext *lc, const bool
> >> local_dual_tree,
> >> +static int palette_signaled(VVCLocalContext *lc, const bool
> >> local_dual_tree,
> >>      const int start, const int end, const int max_entries)
> >>  {
> >>      const VVCSPS *sps         = lc->fc->ps.sps;
> >> @@ -1883,6 +1884,9 @@ static void palette_signaled(VVCLocalContext *lc,
> >> const bool local_dual_tree,
> >>      const int size            = nb_predicted + nb_signaled;
> >>      const bool dual_tree_luma = local_dual_tree && cu->tree_type ==
> >> DUAL_TREE_LUMA;
> >>
> >> +    if (size > max_entries)
> >> +        return AVERROR_INVALIDDATA;
> >> +
> >>      for (int c = start; c < end; c++) {
> >>          Palette *plt = cu->plt + c;
> >>          for (int i = nb_predicted; i < size; i++) {
> >> @@ -1894,6 +1898,8 @@ static void palette_signaled(VVCLocalContext *lc,
> >> const bool local_dual_tree,
> >>          }
> >>          plt->size = size;
> >>      }
> >> +
> >> +    return 0;
> >>  }
> >>
> >>  static void palette_update_predictor(VVCLocalContext *lc, const bool
> >> local_dual_tree, int start, int end,
> >> @@ -2070,7 +2076,7 @@ static int hls_palette_coding(VVCLocalContext *lc,
> >> const VVCTreeType tree_type)
> >>      int max_index                 = 0;
> >>      int prev_run_pos              = 0;
> >>
> >> -    int predictor_size, start, end;
> >> +    int predictor_size, start, end, ret;
> >>      bool reused[VVC_MAX_NUM_PALETTE_PREDICTOR_SIZE];
> >>      uint8_t run_type[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE];
> >>      uint8_t index[MAX_PALETTE_CU_SIZE * MAX_PALETTE_CU_SIZE];
> >> @@ -2083,7 +2089,9 @@ static int hls_palette_coding(VVCLocalContext *lc,
> >> const VVCTreeType tree_type)
> >>      predictor_size = pp[start].size;
> >>      memset(reused, 0, sizeof(reused[0]) * predictor_size);
> >>      palette_predicted(lc, local_dual_tree, start, end, reused,
> >> predictor_size, max_entries);
> >> -    palette_signaled(lc, local_dual_tree, start, end, max_entries);
> >> +    ret = palette_signaled(lc, local_dual_tree, start, end,
> max_entries);
> >> +    if (ret < 0)
> >> +        return ret;
> >>      palette_update_predictor(lc, local_dual_tree, start, end, reused,
> >> predictor_size);
> >>
> >>      if (cu->plt[start].size > 0)
> >> --
> >> 2.47.0
> >>
> >>
> > _______________________________________________
> > ffmpeg-devel mailing list
> > ffmpeg-devel at ffmpeg.org
> > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> >
> > To unsubscribe, visit link above, or email
> > ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".
>
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".
>