From 5076fa30ab6f36955dc711f348a16fd063c1e962 Mon Sep 17 00:00:00 2001 From: Frank Plowman Date: Mon, 5 Feb 2024 15:18:02 +0000 Subject: lavc/vvc: Validate alf_list indexes Signed-off-by: Frank Plowman --- libavcodec/vvc/vvc_ps.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/libavcodec/vvc/vvc_ps.c b/libavcodec/vvc/vvc_ps.c index 2cf156b323..77aad720f7 100644 --- a/libavcodec/vvc/vvc_ps.c +++ b/libavcodec/vvc/vvc_ps.c @@ -998,6 +998,39 @@ int ff_vvc_decode_aps(VVCParamSets *ps, const CodedBitstreamUnit *unit) return ret; } +static int sh_alf_aps(const VVCSH *sh, const VVCFrameParamSets *fps) +{ + if (!sh->r->sh_alf_enabled_flag) + return 0; + + for (int i = 0; i < sh->r->sh_num_alf_aps_ids_luma; i++) { + const VVCALF *alf_aps_luma = fps->alf_list[sh->r->sh_alf_aps_id_luma[i]]; + if (!alf_aps_luma) + return AVERROR_INVALIDDATA; + } + + if (sh->r->sh_alf_cb_enabled_flag || sh->r->sh_alf_cr_enabled_flag) { + const VVCALF *alf_aps_chroma = fps->alf_list[sh->r->sh_alf_aps_id_chroma]; + if (!alf_aps_chroma) + return AVERROR_INVALIDDATA; + } + + if (fps->sps->r->sps_ccalf_enabled_flag) { + if (sh->r->sh_alf_cc_cb_enabled_flag) { + const VVCALF *alf_aps_cc_cr = fps->alf_list[sh->r->sh_alf_cc_cb_aps_id]; + if (!alf_aps_cc_cr) + return AVERROR_INVALIDDATA; + } + if (sh->r->sh_alf_cc_cr_enabled_flag) { + const VVCALF *alf_aps_cc_cr = fps->alf_list[sh->r->sh_alf_cc_cr_aps_id]; + if (!alf_aps_cc_cr) + return AVERROR_INVALIDDATA; + } + } + + return 0; +} + static void sh_slice_address(VVCSH *sh, const H266RawSPS *sps, const VVCPPS *pps) { const int slice_address = sh->r->sh_slice_address; @@ -1116,8 +1149,12 @@ static int sh_derive(VVCSH *sh, const VVCFrameParamSets *fps) const H266RawSPS *sps = fps->sps->r; const H266RawPPS *pps = fps->pps->r; const H266RawPictureHeader *ph = fps->ph.r; + int ret; sh_slice_address(sh, sps, fps->pps); + ret = sh_alf_aps(sh, fps); + if (ret < 0) + return ret; sh_inter(sh, sps, pps); sh_qp_y(sh, pps, ph); sh_deblock_offsets(sh); -- cgit v1.2.3