wrapper/libavc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "Decoder: Fix unsigned integer overflow" am: f7225b7fa5 am: e0d61485b2

Browse source 
Original change: 1414511

Change-Id: I6b1fc7b7cbb0550143836db97aafced9d9f187ab
This commit is contained in:
Treehugger Robot 2020-10-09 20:41:09 +00:00 • committed by Automerger Merge Worker
commit ccf9bb47c0
3 changed files with 52 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

25
decoder/ih264d_parse_bslice.c
View file

@ -1355,6 +1355,7 @@ WORD32 ih264d_parse_bslice(dec_struct_t * ps_dec, UWORD16 u2_first_mb_in_slice)
UWORD32 *pu4_bitstrm_buf = ps_bitstrm->pu4_buffer; UWORD32 *pu4_bitstrm_buf = ps_bitstrm->pu4_buffer;
UWORD32 *pu4_bitstrm_ofst = &ps_bitstrm->u4_ofst; UWORD32 *pu4_bitstrm_ofst = &ps_bitstrm->u4_ofst;
UWORD64 u8_ref_idx_l0, u8_ref_idx_l1;
UWORD32 u4_temp, ui_temp1; UWORD32 u4_temp, ui_temp1;
WORD32 i_temp; WORD32 i_temp;
WORD32 ret; WORD32 ret;
@ -1381,31 +1382,31 @@ WORD32 ih264d_parse_bslice(dec_struct_t * ps_dec, UWORD16 u2_first_mb_in_slice)
COPYTHECONTEXT("SH: num_ref_idx_override_flag", COPYTHECONTEXT("SH: num_ref_idx_override_flag",
ps_slice->u1_num_ref_idx_active_override_flag); ps_slice->u1_num_ref_idx_active_override_flag);
u4_temp = ps_dec->ps_cur_pps->u1_num_ref_idx_lx_active[0]; u8_ref_idx_l0 = ps_dec->ps_cur_pps->u1_num_ref_idx_lx_active[0];
ui_temp1 = ps_dec->ps_cur_pps->u1_num_ref_idx_lx_active[1]; u8_ref_idx_l1 = ps_dec->ps_cur_pps->u1_num_ref_idx_lx_active[1];
if(ps_slice->u1_num_ref_idx_active_override_flag) if(ps_slice->u1_num_ref_idx_active_override_flag)
{ {
u4_temp = 1 + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf); u8_ref_idx_l0 = (UWORD64)1 + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
COPYTHECONTEXT("SH: num_ref_idx_l0_active_minus1", COPYTHECONTEXT("SH: num_ref_idx_l0_active_minus1",
u4_temp - 1); u8_ref_idx_l0 - 1);
ui_temp1 = 1 + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
u8_ref_idx_l1 = (UWORD64)1 + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
COPYTHECONTEXT("SH: num_ref_idx_l1_active_minus1", COPYTHECONTEXT("SH: num_ref_idx_l1_active_minus1",
ui_temp1 - 1); u8_ref_idx_l1 - 1);
} }
{ {
UWORD8 u1_max_ref_idx = MAX_FRAMES; UWORD8 u1_max_ref_idx = H264_MAX_REF_PICS;
if(ps_slice->u1_field_pic_flag) if(ps_slice->u1_field_pic_flag)
{ {
u1_max_ref_idx = MAX_FRAMES << 1; u1_max_ref_idx = H264_MAX_REF_PICS << 1;
} }
if((u4_temp > u1_max_ref_idx) || (ui_temp1 > u1_max_ref_idx) if((u8_ref_idx_l0 > u1_max_ref_idx) || (u8_ref_idx_l1 > u1_max_ref_idx))
|| (u4_temp < 1) || (ui_temp1 < 1))
{ {
return ERROR_NUM_REF; return ERROR_NUM_REF;
} }
ps_slice->u1_num_ref_idx_lx_active[0] = u4_temp; ps_slice->u1_num_ref_idx_lx_active[0] = u8_ref_idx_l0;
ps_slice->u1_num_ref_idx_lx_active[1] = ui_temp1; ps_slice->u1_num_ref_idx_lx_active[1] = u8_ref_idx_l1;
} }

63
decoder/ih264d_parse_headers.c
View file

@ -276,6 +276,7 @@ WORD32 ih264d_parse_pps(dec_struct_t * ps_dec, dec_bit_stream_t * ps_bitstrm)
UWORD32 *pu4_bitstrm_ofst = &ps_dec->ps_bitstrm->u4_ofst; UWORD32 *pu4_bitstrm_ofst = &ps_dec->ps_bitstrm->u4_ofst;
/* Variables used for error resilience checks */ /* Variables used for error resilience checks */
UWORD64 u8_temp;
UWORD32 u4_temp; UWORD32 u4_temp;
WORD32 i_temp; WORD32 i_temp;
@ -328,30 +329,28 @@ WORD32 ih264d_parse_pps(dec_struct_t * ps_dec, dec_bit_stream_t * ps_bitstrm)
/*--------------------------------------------------------------------*/ /*--------------------------------------------------------------------*/
/* Decode num_slice_groups_minus1 */ /* Decode num_slice_groups_minus1 */
/*--------------------------------------------------------------------*/ /*--------------------------------------------------------------------*/
u4_temp = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf) + 1; u8_temp = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf) + (UWORD64)1;
if(u4_temp != 1) if(u8_temp != 1)
{ {
UWORD32 i4_error_code; return ERROR_FEATURE_UNAVAIL;
i4_error_code = ERROR_FEATURE_UNAVAIL;
return i4_error_code;
} }
ps_pps->u1_num_slice_groups = u4_temp; ps_pps->u1_num_slice_groups = u8_temp;
COPYTHECONTEXT("PPS: num_slice_groups_minus1",ps_pps->u1_num_slice_groups -1); COPYTHECONTEXT("PPS: num_slice_groups_minus1",ps_pps->u1_num_slice_groups -1);
/*--------------------------------------------------------------------*/ /*--------------------------------------------------------------------*/
/* Other parameter set values */ /* Other parameter set values */
/*--------------------------------------------------------------------*/ /*--------------------------------------------------------------------*/
u4_temp = 1 + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf); u8_temp = (UWORD64)1 + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
if(u4_temp > H264_MAX_REF_IDX) if(u8_temp > H264_MAX_REF_IDX)
return ERROR_REF_IDX; return ERROR_REF_IDX;
ps_pps->u1_num_ref_idx_lx_active[0] = u4_temp; ps_pps->u1_num_ref_idx_lx_active[0] = u8_temp;
COPYTHECONTEXT("PPS: num_ref_idx_l0_active_minus1", COPYTHECONTEXT("PPS: num_ref_idx_l0_active_minus1",
ps_pps->u1_num_ref_idx_lx_active[0] - 1); ps_pps->u1_num_ref_idx_lx_active[0] - 1);
u4_temp = 1 + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf); u8_temp = (UWORD64)1 + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
if(u4_temp > H264_MAX_REF_IDX) if(u8_temp > H264_MAX_REF_IDX)
return ERROR_REF_IDX; return ERROR_REF_IDX;
ps_pps->u1_num_ref_idx_lx_active[1] = u4_temp; ps_pps->u1_num_ref_idx_lx_active[1] = u8_temp;
COPYTHECONTEXT("PPS: num_ref_idx_l1_active_minus1", COPYTHECONTEXT("PPS: num_ref_idx_l1_active_minus1",
ps_pps->u1_num_ref_idx_lx_active[1] - 1); ps_pps->u1_num_ref_idx_lx_active[1] - 1);
@ -579,6 +578,7 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
UWORD8 u1_frm, uc_constraint_set0_flag, uc_constraint_set1_flag; UWORD8 u1_frm, uc_constraint_set0_flag, uc_constraint_set1_flag;
WORD32 i4_cropped_ht, i4_cropped_wd; WORD32 i4_cropped_ht, i4_cropped_wd;
UWORD32 u4_temp; UWORD32 u4_temp;
UWORD64 u8_temp;
UWORD32 u4_pic_height_in_map_units, u4_pic_width_in_mbs; UWORD32 u4_pic_height_in_map_units, u4_pic_width_in_mbs;
UWORD32 u2_pic_wd = 0; UWORD32 u2_pic_wd = 0;
UWORD32 u2_pic_ht = 0; UWORD32 u2_pic_ht = 0;
@ -773,12 +773,12 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
/*--------------------------------------------------------------------*/ /*--------------------------------------------------------------------*/
/* Decode MaxFrameNum */ /* Decode MaxFrameNum */
/*--------------------------------------------------------------------*/ /*--------------------------------------------------------------------*/
u4_temp = 4 + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf); u8_temp = (UWORD64)4 + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
if(u4_temp > MAX_BITS_IN_FRAME_NUM) if(u8_temp > MAX_BITS_IN_FRAME_NUM)
{ {
return ERROR_INV_SPS_PPS_T; return ERROR_INV_SPS_PPS_T;
} }
ps_seq->u1_bits_in_frm_num = u4_temp; ps_seq->u1_bits_in_frm_num = u8_temp;
COPYTHECONTEXT("SPS: log2_max_frame_num_minus4", COPYTHECONTEXT("SPS: log2_max_frame_num_minus4",
(ps_seq->u1_bits_in_frm_num - 4)); (ps_seq->u1_bits_in_frm_num - 4));
@ -799,14 +799,14 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
ps_seq->u1_num_ref_frames_in_pic_order_cnt_cycle = 1; ps_seq->u1_num_ref_frames_in_pic_order_cnt_cycle = 1;
if(ps_seq->u1_pic_order_cnt_type == 0) if(ps_seq->u1_pic_order_cnt_type == 0)
{ {
u4_temp = 4 + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf); u8_temp = (UWORD64)4 + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
if(u4_temp > MAX_BITS_IN_POC_LSB) if(u8_temp > MAX_BITS_IN_POC_LSB)
{ {
return ERROR_INV_SPS_PPS_T; return ERROR_INV_SPS_PPS_T;
} }
ps_seq->u1_log2_max_pic_order_cnt_lsb_minus = u4_temp; ps_seq->u1_log2_max_pic_order_cnt_lsb_minus = u8_temp;
ps_seq->i4_max_pic_order_cntLsb = (1 << u4_temp); ps_seq->i4_max_pic_order_cntLsb = (1 << u8_temp);
COPYTHECONTEXT("SPS: log2_max_pic_order_cnt_lsb_minus4",(u4_temp - 4)); COPYTHECONTEXT("SPS: log2_max_pic_order_cnt_lsb_minus4",(u8_temp - 4));
} }
else if(ps_seq->u1_pic_order_cnt_type == 1) else if(ps_seq->u1_pic_order_cnt_type == 1)
{ {
@ -866,20 +866,23 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
/*--------------------------------------------------------------------*/ /*--------------------------------------------------------------------*/
/* Decode FrameWidth and FrameHeight and related values */ /* Decode FrameWidth and FrameHeight and related values */
/*--------------------------------------------------------------------*/ /*--------------------------------------------------------------------*/
u4_pic_width_in_mbs = 1 u8_temp = (UWORD64)1 + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
+ ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
COPYTHECONTEXT("SPS: pic_width_in_mbs_minus1",
u4_pic_width_in_mbs - 1);
u4_pic_height_in_map_units = 1 + ih264d_uev(pu4_bitstrm_ofst,
pu4_bitstrm_buf);
/* Check for unsupported resolutions*/ /* Check for unsupported resolutions*/
if((u4_pic_width_in_mbs > (H264_MAX_FRAME_WIDTH >> 4)) || if(u8_temp > (H264_MAX_FRAME_WIDTH >> 4))
(u4_pic_height_in_map_units > (H264_MAX_FRAME_HEIGHT >> 4)))
{ {
return IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED; return IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED;
} }
u4_pic_width_in_mbs = u8_temp;
COPYTHECONTEXT("SPS: pic_width_in_mbs_minus1",
u4_pic_width_in_mbs - 1);
u8_temp = (UWORD64)1 + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
if (u8_temp > (H264_MAX_FRAME_HEIGHT >> 4))
{
return IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED;
}
u4_pic_height_in_map_units = u8_temp;
ps_seq->u2_frm_wd_in_mbs = u4_pic_width_in_mbs; ps_seq->u2_frm_wd_in_mbs = u4_pic_width_in_mbs;
ps_seq->u2_frm_ht_in_mbs = u4_pic_height_in_map_units; ps_seq->u2_frm_ht_in_mbs = u4_pic_height_in_map_units;

14
decoder/ih264d_parse_pslice.c
View file

@ -1927,6 +1927,7 @@ WORD32 ih264d_parse_pslice(dec_struct_t *ps_dec, UWORD16 u2_first_mb_in_slice)
UWORD8 u1_mbaff = ps_dec->ps_cur_slice->u1_mbaff_frame_flag; //ps_dec->ps_cur_sps->u1_mb_aff_flag; UWORD8 u1_mbaff = ps_dec->ps_cur_slice->u1_mbaff_frame_flag; //ps_dec->ps_cur_sps->u1_mb_aff_flag;
UWORD8 u1_field_pic_flag = ps_cur_slice->u1_field_pic_flag; UWORD8 u1_field_pic_flag = ps_cur_slice->u1_field_pic_flag;
UWORD64 u8_ref_idx_l0;
UWORD32 u4_temp; UWORD32 u4_temp;
WORD32 i_temp; WORD32 i_temp;
WORD32 ret; WORD32 ret;
@ -1955,22 +1956,19 @@ WORD32 ih264d_parse_pslice(dec_struct_t *ps_dec, UWORD16 u2_first_mb_in_slice)
COPYTHECONTEXT("SH: num_ref_idx_override_flag", COPYTHECONTEXT("SH: num_ref_idx_override_flag",
ps_cur_slice->u1_num_ref_idx_active_override_flag); ps_cur_slice->u1_num_ref_idx_active_override_flag);
u4_temp = ps_dec->ps_cur_pps->u1_num_ref_idx_lx_active[0]; u8_ref_idx_l0 = ps_dec->ps_cur_pps->u1_num_ref_idx_lx_active[0];
if(ps_cur_slice->u1_num_ref_idx_active_override_flag) if(ps_cur_slice->u1_num_ref_idx_active_override_flag)
{ {
u4_temp = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf) + 1; u8_ref_idx_l0 = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf) + (UWORD64)1;
} }
{ {
UWORD8 u1_max_ref_idx = H264_MAX_REF_PICS << u1_field_pic_flag;
if(u8_ref_idx_l0 > u1_max_ref_idx)
UWORD8 u1_max_ref_idx = MAX_FRAMES << u1_field_pic_flag;
if(u4_temp > u1_max_ref_idx || u4_temp < 1)
{ {
return ERROR_NUM_REF; return ERROR_NUM_REF;
} }
ps_cur_slice->u1_num_ref_idx_lx_active[0] = u4_temp; ps_cur_slice->u1_num_ref_idx_lx_active[0] = u8_ref_idx_l0;
COPYTHECONTEXT("SH: num_ref_idx_l0_active_minus1", COPYTHECONTEXT("SH: num_ref_idx_l0_active_minus1",
ps_cur_slice->u1_num_ref_idx_lx_active[0] - 1); ps_cur_slice->u1_num_ref_idx_lx_active[0] - 1);