lavc/vvc: Validate IBC block vector

From H.266 (V3) (09/2023) p. 321:

It is a requirement of bitstream conformance that the luma block
vector bvL shall obey the following constraints:
- CtbSizeY is greater than or equal to
((yCb + (bvL[ 1 ] >> 4)) & (CtbSizeY − 1)) + cbHeight

This patch checks this is true, which fixes crashes on fuzzed
bitstreams.

Signed-off-by: Frank Plowman <post@frankplowman.com>

3 files changed, 36 insertions, 8 deletions

diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c
index ce79f14288..bd0be2d821 100644
--- a/libavcodec/vvc/ctu.c
+++ b/libavcodec/vvc/ctu.c
@@ -1444,20 +1444,25 @@ static void merge_data_block(VVCLocalContext *lc)
     }
 }
 
-static void merge_data_ibc(VVCLocalContext *lc)
+static int merge_data_ibc(VVCLocalContext *lc)
 {
     const VVCFrameContext* fc = lc->fc;
     const VVCSPS* sps         = fc->ps.sps;
     MotionInfo *mi            = &lc->cu->pu.mi;
     int merge_idx             = 0;
+    int ret;
 
     mi->pred_flag = PF_IBC;
 
     if (sps->max_num_ibc_merge_cand > 1)
         merge_idx = ff_vvc_merge_idx(lc);
 
-    ff_vvc_luma_mv_merge_ibc(lc, merge_idx, &mi->mv[L0][0]);
+    ret = ff_vvc_luma_mv_merge_ibc(lc, merge_idx, &mi->mv[L0][0]);
+    if (ret)
+        return ret;
     ff_vvc_store_mv(lc, mi);
+
+    return 0;
 }
 
 static int hls_merge_data(VVCLocalContext *lc)
@@ -1466,11 +1471,14 @@ static int hls_merge_data(VVCLocalContext *lc)
     const VVCPH  *ph            = &fc->ps.ph;
     const CodingUnit *cu        = lc->cu;
     PredictionUnit *pu          = &lc->cu->pu;
+    int ret;
 
     pu->merge_gpm_flag = 0;
     pu->mi.num_sb_x = pu->mi.num_sb_y = 1;
     if (cu->pred_mode == MODE_IBC) {
-        merge_data_ibc(lc);
+        ret = merge_data_ibc(lc);
+        if (ret)
+            return ret;
     } else {
         if (ph->max_num_subblock_merge_cand > 0 && cu->cb_width >= 8 && cu->cb_height >= 8)
             pu->merge_subblock_flag = ff_vvc_merge_subblock_flag(lc);
@@ -1596,6 +1604,7 @@ static int mvp_data_ibc(VVCLocalContext *lc)
     int mvp_l0_flag           = 0;
     int amvr_shift            = 4;
     Mv *mv                    = &mi->mv[L0][0];
+    int ret;
 
     mi->pred_flag = PF_IBC;
     mi->num_sb_x  = 1;
@@ -1607,7 +1616,9 @@ static int mvp_data_ibc(VVCLocalContext *lc)
     if (sps->r->sps_amvr_enabled_flag && (mv->x || mv->y))
         amvr_shift = ff_vvc_amvr_shift(lc, pu->inter_affine_flag, cu->pred_mode, 1);
 
-    ff_vvc_mvp_ibc(lc, mvp_l0_flag, amvr_shift, mv);
+    ret = ff_vvc_mvp_ibc(lc, mvp_l0_flag, amvr_shift, mv);
+    if (ret)
+        return ret;
     ff_vvc_store_mv(lc, mi);
 
     return 0;
diff --git a/libavcodec/vvc/mvs.c b/libavcodec/vvc/mvs.c
index 42564b3e6f..1788a7150b 100644
--- a/libavcodec/vvc/mvs.c
+++ b/libavcodec/vvc/mvs.c
@@ -1695,17 +1695,34 @@ static void ibc_merge_candidates(VVCLocalContext *lc, const int merge_idx, Mv *m
     memset(mv, 0, sizeof(*mv));
 }
 
-void ff_vvc_mvp_ibc(VVCLocalContext *lc, const int mvp_l0_flag, const int amvr_shift, Mv *mv)
+static int ibc_check_mv(VVCLocalContext *lc, Mv *mv)
+{
+    const VVCFrameContext *fc = lc->fc;
+    const VVCSPS *sps         = lc->fc->ps.sps;
+    const CodingUnit *cu      = lc->cu;
+    const Mv *bv              = &cu->pu.mi.mv[L0][0];
+
+    if (sps->ctb_size_y < ((cu->y0 + (bv->y >> 4)) & (sps->ctb_size_y - 1)) + cu->cb_height) {
+        av_log(fc->log_ctx, AV_LOG_ERROR, "IBC region spans multiple CTBs.\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    return 0;
+}
+
+int ff_vvc_mvp_ibc(VVCLocalContext *lc, const int mvp_l0_flag, const int amvr_shift, Mv *mv)
 {
     LOCAL_ALIGNED_8(Mv, mvp, [1]);
 
     ibc_merge_candidates(lc, mvp_l0_flag, mvp);
     ibc_add_mvp(mv, mvp, amvr_shift);
+    return ibc_check_mv(lc, mv);
 }
 
-void ff_vvc_luma_mv_merge_ibc(VVCLocalContext *lc, const int merge_idx, Mv *mv)
+int ff_vvc_luma_mv_merge_ibc(VVCLocalContext *lc, const int merge_idx, Mv *mv)
 {
     ibc_merge_candidates(lc, merge_idx, mv);
+    return ibc_check_mv(lc, mv);
 }
 
 static int affine_mvp_constructed_cp(NeighbourContext *ctx,
diff --git a/libavcodec/vvc/mvs.h b/libavcodec/vvc/mvs.h
index 3f0c8b08e9..b2242b2a4d 100644
--- a/libavcodec/vvc/mvs.h
+++ b/libavcodec/vvc/mvs.h
@@ -30,9 +30,9 @@ void ff_vvc_clip_mv(Mv *mv);
 void ff_vvc_mv_scale(Mv *dst, const Mv *src, int td, int tb);
 void ff_vvc_luma_mv_merge_mode(VVCLocalContext *lc, int merge_idx, int ciip_flag, MvField *mv);
 void ff_vvc_luma_mv_merge_gpm(VVCLocalContext *lc, const int merge_gpm_idx[2], MvField *mv);
-void ff_vvc_luma_mv_merge_ibc(VVCLocalContext *lc, int merge_idx, Mv *mv);
+int ff_vvc_luma_mv_merge_ibc(VVCLocalContext *lc, int merge_idx, Mv *mv);
 void ff_vvc_mvp(VVCLocalContext *lc, const int *mvp_lx_flag, const int amvr_shift,  MotionInfo *mi);
-void ff_vvc_mvp_ibc(VVCLocalContext *lc, int mvp_l0_flag, int amvr_shift, Mv *mv);
+int ff_vvc_mvp_ibc(VVCLocalContext *lc, int mvp_l0_flag, int amvr_shift, Mv *mv);
 void ff_vvc_sb_mv_merge_mode(VVCLocalContext *lc, int merge_subblock_idx, PredictionUnit *pu);
 void ff_vvc_affine_mvp(VVCLocalContext *lc, const int *mvp_lx_flag, const int amvr_shift, MotionInfo* mi);
 void ff_vvc_store_sb_mvs(const VVCLocalContext *lc, PredictionUnit *pu);