[FFmpeg-devel] [PATCH] lavc/vvc: Error pps_single_slice_per_subpic_flag

[post at frankplowman.com]

From: Frank Plowman <post at frankplowman.com>

pps_single_slice_per_subpic_flag is not yet supported.  Support is WIP,
but in the meantime throw an error when trying to decode a bitstream
with it set, avoiding an out-of-bounds array access.

Fixes: out-of-bounds array access for conformance bitstreams
SUBPIC_C_ERICSSON_1, SUBPIC_D_ERICSSON_1, MNUT_A_Nokia_4 and
MNUT_B_Nokia_3.

Signed-off-by: Frank Plowman <post at frankplowman.com>
---
 libavcodec/vvc/vvc_ps.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/libavcodec/vvc/vvc_ps.c b/libavcodec/vvc/vvc_ps.c
index 2cf156b323..bd81d70e71 100644
--- a/libavcodec/vvc/vvc_ps.c
+++ b/libavcodec/vvc/vvc_ps.c
@@ -381,11 +381,16 @@ static void pps_multi_tiles_slice(VVCPPS *pps, const int tile_idx, const int i,
     }
 }
 
-static void pps_rect_slice(VVCPPS* pps)
+static int pps_rect_slice(VVCPPS* pps)
 {
     const H266RawPPS* r = pps->r;
     int tile_idx = 0, off = 0;
 
+    if (r->pps_single_slice_per_subpic_flag) {
+        avpriv_report_missing_feature(NULL, "pps_single_slice_per_subpic_flag");
+        return AVERROR_PATCHWELCOME;
+    }
+
     for (int i = 0; i < r->pps_num_slices_in_pic_minus1 + 1; i++) {
         if (!r->pps_slice_width_in_tiles_minus1[i] &&
             !r->pps_slice_height_in_tiles_minus1[i]) {
@@ -396,9 +401,11 @@ static void pps_rect_slice(VVCPPS* pps)
         }
         tile_idx = next_tile_idx(tile_idx, i, r);
     }
+
+    return 0;
 }
 
-static void pps_no_rect_slice(VVCPPS* pps)
+static int pps_no_rect_slice(VVCPPS* pps)
 {
     const H266RawPPS* r = pps->r;
     int ctu_x, ctu_y, off = 0;
@@ -409,20 +416,24 @@ static void pps_no_rect_slice(VVCPPS* pps)
             pps_add_ctus(pps, &off, ctu_x, ctu_y, r->col_width_val[tile_x], r->row_height_val[tile_y]);
         }
     }
+
+    return 0;
 }
 
 static int pps_slice_map(VVCPPS *pps)
 {
+    int ret;
+
     pps->ctb_addr_in_slice = av_calloc(pps->ctb_count, sizeof(*pps->ctb_addr_in_slice));
     if (!pps->ctb_addr_in_slice)
         return AVERROR(ENOMEM);
 
     if (pps->r->pps_rect_slice_flag)
-        pps_rect_slice(pps);
+        ret = pps_rect_slice(pps);
     else
-        pps_no_rect_slice(pps);
+        ret = pps_no_rect_slice(pps);
 
-    return 0;
+    return ret;
 }
 
 static void pps_ref_wraparound_offset(VVCPPS *pps, const VVCSPS *sps)
-- 
2.43.0