wrapper/libavc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "Decoder: Integer overflow fixes in parsing Qp and weights"

Browse source
This commit is contained in:
Treehugger Robot 2020-08-20 15:24:02 +00:00 • committed by Gerrit Code Review
commit 2baef25896
6 changed files with 35 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

5
decoder/ih264d_defs.h
View file

@ -602,8 +602,9 @@ enum
#define DISP_BOT_FLD_FIRST 2
/** Misc error resilience requirements*/
#define MASK_LOG2_WEIGHT_DENOM 0xFFFFFFF8
#define MASK_PRED_WEIGHT_OFFSET 0xFFFFFF00
#define MAX_LOG2_WEIGHT_DENOM 7
#define PRED_WEIGHT_MIN (-128)
#define PRED_WEIGHT_MAX 127
#define MAX_REDUNDANT_PIC_CNT 127

9
decoder/ih264d_parse_bslice.c
View file

@ -34,6 +34,7 @@
*/
#include <string.h>
#include "ih264_defs.h"
#include "ih264d_bitstrm.h"
#include "ih264d_defs.h"
#include "ih264d_debug.h"
@ -1600,13 +1601,13 @@ WORD32 ih264d_parse_bslice(dec_struct_t * ps_dec, UWORD16 u2_first_mb_in_slice)
}
/* Read slice_qp_delta */
i_temp = ps_pps->u1_pic_init_qp
+ ih264d_sev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
if((i_temp < 0) || (i_temp > 51))
WORD64 i8_temp = (WORD64)ps_pps->u1_pic_init_qp
+ ih264d_sev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
if((i8_temp < MIN_H264_QP) || (i8_temp > MAX_H264_QP))
{
return ERROR_INV_RANGE_QP_T;
}
ps_slice->u1_slice_qp = i_temp;
ps_slice->u1_slice_qp = i8_temp;
COPYTHECONTEXT("SH: slice_qp_delta",
(WORD8)(ps_slice->u1_slice_qp - ps_pps->u1_pic_init_qp));

14
decoder/ih264d_parse_headers.c
View file

@ -35,6 +35,7 @@
#include "ih264_typedefs.h"
#include "ih264_macros.h"
#include "ih264_platform_macros.h"
#include "ih264_defs.h"
#include "ih264d_bitstrm.h"
#include "ih264d_structs.h"
#include "ih264d_parse_cavlc.h"
@ -363,20 +364,21 @@ WORD32 ih264d_parse_pps(dec_struct_t * ps_dec, dec_bit_stream_t * ps_bitstrm)
if(ps_pps->u1_wted_bipred_idc > MAX_WEIGHT_BIPRED_IDC)
return ERROR_INV_SPS_PPS_T;
i_temp = 26 + ih264d_sev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
WORD64 i8_temp = (WORD64)26
+ ih264d_sev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
if((i_temp < 0) || (i_temp > 51))
if((i8_temp < MIN_H264_QP) || (i8_temp > MAX_H264_QP))
return ERROR_INV_RANGE_QP_T;
ps_pps->u1_pic_init_qp = i_temp;
ps_pps->u1_pic_init_qp = i8_temp;
COPYTHECONTEXT("PPS: pic_init_qp_minus26",ps_pps->u1_pic_init_qp - 26);
i_temp = 26 + ih264d_sev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
i8_temp = (WORD64)26 + ih264d_sev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
if((i_temp < 0) || (i_temp > 51))
if((i8_temp < MIN_H264_QP) || (i8_temp > MAX_H264_QP))
return ERROR_INV_RANGE_QP_T;
ps_pps->u1_pic_init_qs = i_temp;
ps_pps->u1_pic_init_qs = i8_temp;
COPYTHECONTEXT("PPS: pic_init_qs_minus26",ps_pps->u1_pic_init_qs - 26);
i_temp = ih264d_sev(pu4_bitstrm_ofst, pu4_bitstrm_buf);

11
decoder/ih264d_parse_islice.c
View file

@ -33,9 +33,10 @@
* \author NS
**************************************************************************
*/
#include <string.h>
#include "ih264_defs.h"
#include "ih264d_error_handler.h"
#include "ih264d_debug.h"
#include <string.h>
#include "ih264d_bitstrm.h"
#include "ih264d_defs.h"
#include "ih264d_debug.h"
@ -1399,11 +1400,11 @@ WORD32 ih264d_parse_islice(dec_struct_t *ps_dec,
/* G050 */
/* Read slice_qp_delta */
i_temp = ps_pps->u1_pic_init_qp
+ ih264d_sev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
if((i_temp < 0) || (i_temp > 51))
WORD64 i8_temp = (WORD64)ps_pps->u1_pic_init_qp
+ ih264d_sev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
if((i8_temp < MIN_H264_QP) || (i8_temp > MAX_H264_QP))
return ERROR_INV_RANGE_QP_T;
ps_slice->u1_slice_qp = i_temp;
ps_slice->u1_slice_qp = i8_temp;
COPYTHECONTEXT("SH: slice_qp_delta",
ps_slice->u1_slice_qp - ps_pps->u1_pic_init_qp);

9
decoder/ih264d_parse_pslice.c
View file

@ -35,6 +35,7 @@
*/
#include <string.h>
#include "ih264_defs.h"
#include "ih264d_bitstrm.h"
#include "ih264d_defs.h"
#include "ih264d_debug.h"
@ -2130,13 +2131,13 @@ WORD32 ih264d_parse_pslice(dec_struct_t *ps_dec, UWORD16 u2_first_mb_in_slice)
}
/* Read slice_qp_delta */
i_temp = ps_pps->u1_pic_init_qp
+ ih264d_sev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
if((i_temp < 0) || (i_temp > 51))
WORD64 i8_temp = (WORD64)ps_pps->u1_pic_init_qp
+ ih264d_sev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
if((i8_temp < MIN_H264_QP) || (i8_temp > MAX_H264_QP))
{
return ERROR_INV_RANGE_QP_T;
}
ps_cur_slice->u1_slice_qp = i_temp;
ps_cur_slice->u1_slice_qp = i8_temp;
COPYTHECONTEXT("SH: slice_qp_delta",
(WORD8)(ps_cur_slice->u1_slice_qp - ps_pps->u1_pic_init_qp));

16
decoder/ih264d_process_pslice.c
View file

@ -829,7 +829,7 @@ WORD32 ih264d_parse_pred_weight_table(dec_slice_params_t * ps_cur_slice,
WORD32 i_temp;
u4_temp = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
if(u4_temp & MASK_LOG2_WEIGHT_DENOM)
if(u4_temp > MAX_LOG2_WEIGHT_DENOM)
{
return ERROR_PRED_WEIGHT_TABLE_T;
}
@ -838,7 +838,7 @@ WORD32 ih264d_parse_pred_weight_table(dec_slice_params_t * ps_cur_slice,
ui32_y_def_weight_ofst = (1 << uc_luma_log2_weight_denom);
u4_temp = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
if(u4_temp & MASK_LOG2_WEIGHT_DENOM)
if(u4_temp > MAX_LOG2_WEIGHT_DENOM)
{
return ERROR_PRED_WEIGHT_TABLE_T;
}
@ -864,14 +864,14 @@ WORD32 ih264d_parse_pred_weight_table(dec_slice_params_t * ps_cur_slice,
{
i_temp = ih264d_sev(pu4_bitstrm_ofst,
pu4_bitstrm_buf);
if((i_temp + 128) & MASK_PRED_WEIGHT_OFFSET)
if((i_temp < PRED_WEIGHT_MIN) || (i_temp > PRED_WEIGHT_MAX))
return ERROR_PRED_WEIGHT_TABLE_T;
c_weight = i_temp;
COPYTHECONTEXT("SH: luma_weight_l0",c_weight);
i_temp = ih264d_sev(pu4_bitstrm_ofst,
pu4_bitstrm_buf);
if((i_temp + 128) & MASK_PRED_WEIGHT_OFFSET)
if((i_temp < PRED_WEIGHT_MIN) || (i_temp > PRED_WEIGHT_MAX))
return ERROR_PRED_WEIGHT_TABLE_T;
c_offset = i_temp;
COPYTHECONTEXT("SH: luma_offset_l0",c_offset);
@ -894,14 +894,14 @@ WORD32 ih264d_parse_pred_weight_table(dec_slice_params_t * ps_cur_slice,
{
i_temp = ih264d_sev(pu4_bitstrm_ofst,
pu4_bitstrm_buf);
if((i_temp + 128) & MASK_PRED_WEIGHT_OFFSET)
if((i_temp < PRED_WEIGHT_MIN) || (i_temp > PRED_WEIGHT_MAX))
return ERROR_PRED_WEIGHT_TABLE_T;
c_weightCb = i_temp;
COPYTHECONTEXT("SH: chroma_weight_l0",c_weightCb);
i_temp = ih264d_sev(pu4_bitstrm_ofst,
pu4_bitstrm_buf);
if((i_temp + 128) & MASK_PRED_WEIGHT_OFFSET)
if((i_temp < PRED_WEIGHT_MIN) || (i_temp > PRED_WEIGHT_MAX))
return ERROR_PRED_WEIGHT_TABLE_T;
c_offsetCb = i_temp;
COPYTHECONTEXT("SH: chroma_weight_l0",c_offsetCb);
@ -911,14 +911,14 @@ WORD32 ih264d_parse_pred_weight_table(dec_slice_params_t * ps_cur_slice,
i_temp = ih264d_sev(pu4_bitstrm_ofst,
pu4_bitstrm_buf);
if((i_temp + 128) & MASK_PRED_WEIGHT_OFFSET)
if((i_temp < PRED_WEIGHT_MIN) || (i_temp > PRED_WEIGHT_MAX))
return ERROR_PRED_WEIGHT_TABLE_T;
c_weightCr = i_temp;
COPYTHECONTEXT("SH: chroma_weight_l0",c_weightCr);
i_temp = ih264d_sev(pu4_bitstrm_ofst,
pu4_bitstrm_buf);
if((i_temp + 128) & MASK_PRED_WEIGHT_OFFSET)
if((i_temp < PRED_WEIGHT_MIN) || (i_temp > PRED_WEIGHT_MAX))
return ERROR_PRED_WEIGHT_TABLE_T;
c_offsetCr = i_temp;
COPYTHECONTEXT("SH: chroma_weight_l0",c_offsetCr);