lavc/vvc: Validate alf_list indexes

Signed-off-by: Frank Plowman <post@frankplowman.com>

libavcodec/vvc/vvc_ps.c

@@ -998,6 +998,39 @@ int ff_vvc_decode_aps(VVCParamSets *ps, const CodedBitstreamUnit *unit)
     return ret;
 }
 
+static int sh_alf_aps(const VVCSH *sh, const VVCFrameParamSets *fps)
+{
+    if (!sh->r->sh_alf_enabled_flag)
+        return 0;
+
+    for (int i = 0; i < sh->r->sh_num_alf_aps_ids_luma; i++) {
+        const VVCALF *alf_aps_luma = fps->alf_list[sh->r->sh_alf_aps_id_luma[i]];
+        if (!alf_aps_luma)
+            return AVERROR_INVALIDDATA;
+    }
+
+    if (sh->r->sh_alf_cb_enabled_flag || sh->r->sh_alf_cr_enabled_flag) {
+        const VVCALF *alf_aps_chroma = fps->alf_list[sh->r->sh_alf_aps_id_chroma];
+        if (!alf_aps_chroma)
+            return AVERROR_INVALIDDATA;
+    }
+
+    if (fps->sps->r->sps_ccalf_enabled_flag) {
+        if (sh->r->sh_alf_cc_cb_enabled_flag) {
+            const VVCALF *alf_aps_cc_cr = fps->alf_list[sh->r->sh_alf_cc_cb_aps_id];
+            if (!alf_aps_cc_cr)
+                return AVERROR_INVALIDDATA;
+        }
+        if (sh->r->sh_alf_cc_cr_enabled_flag) {
+            const VVCALF *alf_aps_cc_cr = fps->alf_list[sh->r->sh_alf_cc_cr_aps_id];
+            if (!alf_aps_cc_cr)
+                return AVERROR_INVALIDDATA;
+        }
+    }
+
+    return 0;
+}
+
 static void sh_slice_address(VVCSH *sh, const H266RawSPS *sps, const VVCPPS *pps)
 {
     const int slice_address     = sh->r->sh_slice_address;
@@ -1116,8 +1149,12 @@ static int sh_derive(VVCSH *sh, const VVCFrameParamSets *fps)
     const H266RawSPS *sps           = fps->sps->r;
     const H266RawPPS *pps           = fps->pps->r;
     const H266RawPictureHeader *ph  = fps->ph.r;
+    int ret;
 
     sh_slice_address(sh, sps, fps->pps);
+    ret = sh_alf_aps(sh, fps);
+    if (ret < 0)
+        return ret;
     sh_inter(sh, sps, pps);
     sh_qp_y(sh, pps, ph);
     sh_deblock_offsets(sh);