Traneptora/FFmpeg
1
Fork 0
forked from FFmpeg/FFmpeg
Code Pull requests Activity

lavc/vvc: Validate temporal MVP references

Browse source 
Per VVCv3 p. 157, the collocated reference picture used in temporal
motion vector prediction must have RprConstraintsActiveFlag equal to
zero and the same CTU size as the current picture.  Add these checks,
fixing crashes decoding some fuzzed bitstreams.

Additionally, only set up the collocated reference picture if it is
actually going to be used (i.e. if ph_temporal_mvp_enabled_flag is 1),
else legal RPR bitstreams will fail the new checks.

Co-authored-by: Nuo Mi <nuomi2021@gmail.com>
Signed-off-by: Frank Plowman <post@frankplowman.com>
This commit is contained in:
Frank Plowman 2024-05-26 10:16:18 +01:00 • committed by Nuo Mi
parent 2b11a8b95b
commit 49c3918c1a
1 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
libavcodec/vvc/refs.c
View file

@ -506,9 +506,14 @@ int ff_vvc_slice_rpl(VVCContext *s, VVCFrameContext *fc, SliceContext *sc)
return ret;
}
}
if ((!rsh->sh_collocated_from_l0_flag) == lx &&
rsh->sh_collocated_ref_idx < rpl->nb_refs)
fc->ref->collocated_ref = rpl->refs[rsh->sh_collocated_ref_idx].ref;
if (ph->r->ph_temporal_mvp_enabled_flag &&
(!rsh->sh_collocated_from_l0_flag) == lx &&
rsh->sh_collocated_ref_idx < rpl->nb_refs) {
const VVCRefPic *refp = rpl->refs + rsh->sh_collocated_ref_idx;
if (refp->is_scaled || refp->ref->sps->ctb_log2_size_y != sps->ctb_log2_size_y)
return AVERROR_INVALIDDATA;
fc->ref->collocated_ref = refp->ref;
}
}
return 0;
}