[FFmpeg-devel] [PATCH] lavc/vvc: Fix divide-by-zero in LMCS param derivation

[Nuo Mi]

On Sat, May 24, 2025 at 8:13 PM Frank Plowman <post at frankplowman.com> wrote:

> Add three missing requirements on bitstream conformance from 7.4.3.19 of
> H.266 (V3).  Issue found using fuzzing.
>
Thank you, Frank.
Applied with slight style changes.

>
> Signed-off-by: Frank Plowman <post at frankplowman.com>
> ---
>  libavcodec/vvc/ps.c | 18 +++++++++++++++---
>  1 file changed, 15 insertions(+), 3 deletions(-)
>
> diff --git a/libavcodec/vvc/ps.c b/libavcodec/vvc/ps.c
> index 1f3c2edbb7..3228ea6803 100644
> --- a/libavcodec/vvc/ps.c
> +++ b/libavcodec/vvc/ps.c
> @@ -849,7 +849,7 @@ static int lmcs_derive_lut(VVCLMCS *lmcs, const
> H266RawAPS *rlmcs, const H266Raw
>      uint16_t input_pivot[LMCS_MAX_BIN_SIZE];
>      uint16_t scale_coeff[LMCS_MAX_BIN_SIZE];
>      uint16_t inv_scale_coeff[LMCS_MAX_BIN_SIZE];
> -    int i, delta_crs;
> +    int i, delta_crs, sum_cw;
>      if (bit_depth > LMCS_MAX_BIT_DEPTH)
>          return AVERROR_PATCHWELCOME;
>
> @@ -860,8 +860,13 @@ static int lmcs_derive_lut(VVCLMCS *lmcs, const
> H266RawAPS *rlmcs, const H266Raw
>      lmcs->max_bin_idx = LMCS_MAX_BIN_SIZE - 1 -
> rlmcs->lmcs_delta_max_bin_idx;
>
>      memset(cw, 0, sizeof(cw));
> -    for (int i = lmcs->min_bin_idx; i <= lmcs->max_bin_idx; i++)
> +    sum_cw = 0;
> +    for (int i = lmcs->min_bin_idx; i <= lmcs->max_bin_idx; i++) {
>          cw[i] = org_cw + (1 - 2 * rlmcs->lmcs_delta_sign_cw_flag[i]) *
> rlmcs->lmcs_delta_abs_cw[i];
> +        sum_cw += cw[i];
> +    }
> +    if (sum_cw > (1 << bit_depth) - 1)
> +        return AVERROR_INVALIDDATA;
>
>      delta_crs = (1 - 2 * rlmcs->lmcs_delta_sign_crs_flag) *
> rlmcs->lmcs_delta_abs_crs;
>
> @@ -869,13 +874,20 @@ static int lmcs_derive_lut(VVCLMCS *lmcs, const
> H266RawAPS *rlmcs, const H266Raw
>      for (i = 0; i < LMCS_MAX_BIN_SIZE; i++) {
>          input_pivot[i]        = i * org_cw;
>          lmcs->pivot[i + 1] = lmcs->pivot[i] + cw[i];
> +        if (i >= lmcs->min_bin_idx && i <= lmcs->max_bin_idx
> +         && lmcs->pivot[i] % (1 << (bit_depth - 5)) != 0
> +         && lmcs->pivot[i] >> (bit_depth - 5) == lmcs->pivot[i + 1] >>
> (bit_depth - 5))
> +            return AVERROR_INVALIDDATA;
>          scale_coeff[i]        = (cw[i] * (1 << 11) +  off) >> shift;
>          if (cw[i] == 0) {
>              inv_scale_coeff[i] = 0;
>              lmcs->chroma_scale_coeff[i] = (1 << 11);
>          } else {
> +            const int cw_plus_d = cw[i] + delta_crs;
> +            if (cw_plus_d < (org_cw >> 3) || cw_plus_d > ((org_cw << 3) -
> 1))
> +                return AVERROR_INVALIDDATA;
>              inv_scale_coeff[i] = org_cw * (1 << 11) / cw[i];
> -            lmcs->chroma_scale_coeff[i] = org_cw * (1 << 11) / (cw[i] +
> delta_crs);
> +            lmcs->chroma_scale_coeff[i] = org_cw * (1 << 11) / cw_plus_d;
>          }
>      }
>
> --
> 2.47.0
>
>