lavc/vvc: Validate IBC block vector

From H.266 (V3) (09/2023) p. 321:

It is a requirement of bitstream conformance that the luma block
vector bvL shall obey the following constraints:
- CtbSizeY is greater than or equal to
((yCb + (bvL[ 1 ] >> 4)) & (CtbSizeY − 1)) + cbHeight

This patch checks this is true, which fixes crashes on fuzzed
bitstreams.

Signed-off-by: Frank Plowman <post@frankplowman.com>

1 files changed, 15 insertions, 4 deletions

diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c
index ce79f14288..bd0be2d821 100644
--- a/libavcodec/vvc/ctu.c
+++ b/libavcodec/vvc/ctu.c
@@ -1444,20 +1444,25 @@ static void merge_data_block(VVCLocalContext *lc)
     }
 }
 
-static void merge_data_ibc(VVCLocalContext *lc)
+static int merge_data_ibc(VVCLocalContext *lc)
 {
     const VVCFrameContext* fc = lc->fc;
     const VVCSPS* sps         = fc->ps.sps;
     MotionInfo *mi            = &lc->cu->pu.mi;
     int merge_idx             = 0;
+    int ret;
 
     mi->pred_flag = PF_IBC;
 
     if (sps->max_num_ibc_merge_cand > 1)
         merge_idx = ff_vvc_merge_idx(lc);
 
-    ff_vvc_luma_mv_merge_ibc(lc, merge_idx, &mi->mv[L0][0]);
+    ret = ff_vvc_luma_mv_merge_ibc(lc, merge_idx, &mi->mv[L0][0]);
+    if (ret)
+        return ret;
     ff_vvc_store_mv(lc, mi);
+
+    return 0;
 }
 
 static int hls_merge_data(VVCLocalContext *lc)
@@ -1466,11 +1471,14 @@ static int hls_merge_data(VVCLocalContext *lc)
     const VVCPH  *ph            = &fc->ps.ph;
     const CodingUnit *cu        = lc->cu;
     PredictionUnit *pu          = &lc->cu->pu;
+    int ret;
 
     pu->merge_gpm_flag = 0;
     pu->mi.num_sb_x = pu->mi.num_sb_y = 1;
     if (cu->pred_mode == MODE_IBC) {
-        merge_data_ibc(lc);
+        ret = merge_data_ibc(lc);
+        if (ret)
+            return ret;
     } else {
         if (ph->max_num_subblock_merge_cand > 0 && cu->cb_width >= 8 && cu->cb_height >= 8)
             pu->merge_subblock_flag = ff_vvc_merge_subblock_flag(lc);
@@ -1596,6 +1604,7 @@ static int mvp_data_ibc(VVCLocalContext *lc)
     int mvp_l0_flag           = 0;
     int amvr_shift            = 4;
     Mv *mv                    = &mi->mv[L0][0];
+    int ret;
 
     mi->pred_flag = PF_IBC;
     mi->num_sb_x  = 1;
@@ -1607,7 +1616,9 @@ static int mvp_data_ibc(VVCLocalContext *lc)
     if (sps->r->sps_amvr_enabled_flag && (mv->x || mv->y))
         amvr_shift = ff_vvc_amvr_shift(lc, pu->inter_affine_flag, cu->pred_mode, 1);
 
-    ff_vvc_mvp_ibc(lc, mvp_l0_flag, amvr_shift, mv);
+    ret = ff_vvc_mvp_ibc(lc, mvp_l0_flag, amvr_shift, mv);
+    if (ret)
+        return ret;
     ff_vvc_store_mv(lc, mi);
 
     return 0;