generic-library/openh264
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge pull request #2170 from HaiboZhu/Bugfix_entropy_decoding_upper_check

Browse Source 
Add protection for unsigned int output
This commit is contained in:
HaiboZhu 2015-10-19 16:31:15 +08:00
commit 3ee8784c01
3 changed files with 15 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
codec/decoder/core/inc/dec_golomb.h
View File

@ -179,7 +179,7 @@ static inline uint32_t BsGetUe (PBitStringAux pBs, uint32_t* pCode) {
DUMP_BITS (pBs->uiCurBits, pBs->pCurBuf, pBs->iLeftBits, iLeadingZeroBits, iAllowedBytes, iReadBytes); DUMP_BITS (pBs->uiCurBits, pBs->pCurBuf, pBs->iLeftBits, iLeadingZeroBits, iAllowedBytes, iReadBytes);
} }
*pCode = ((1 << iLeadingZeroBits) - 1 + iValue); *pCode = ((1u << iLeadingZeroBits) - 1 + iValue);
return ERR_NONE; return ERR_NONE;
} }

4
codec/decoder/core/src/cabac_decoder.cpp
View File

@ -273,8 +273,8 @@ int32_t DecodeExpBypassCabac (PWelsCabacDecEngine pDecEngine, int32_t iCount, ui
iSymTmp += (1 << iCount); iSymTmp += (1 << iCount);
++iCount; ++iCount;
} }
} while (uiCode != 0 && iCount != 31); } while (uiCode != 0 && iCount != 16);
if (iCount == 31) { if (iCount == 16) {
return ERR_CABAC_UNEXPECTED_VALUE; return ERR_CABAC_UNEXPECTED_VALUE;
} }

26
codec/decoder/core/src/decoder_core.cpp
View File

@ -389,25 +389,25 @@ int32_t ParseDecRefPicMarking (PWelsDecoderContext pCtx, PBitStringAux pBs, PSli
int32_t iIdx = 0; int32_t iIdx = 0;
do { do {
WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //memory_management_control_operation WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //memory_management_control_operation
const int32_t kiMmco = uiCode; const uint32_t kuiMmco = uiCode;
kpRefMarking->sMmcoRef[iIdx].uiMmcoType = kiMmco; kpRefMarking->sMmcoRef[iIdx].uiMmcoType = kuiMmco;
if (kiMmco == MMCO_END) if (kuiMmco == MMCO_END)
break; break;
if (kiMmco == MMCO_SHORT2UNUSED || kiMmco == MMCO_SHORT2LONG) { if (kuiMmco == MMCO_SHORT2UNUSED || kuiMmco == MMCO_SHORT2LONG) {
WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //difference_of_pic_nums_minus1 WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //difference_of_pic_nums_minus1
kpRefMarking->sMmcoRef[iIdx].iDiffOfPicNum = 1 + uiCode; kpRefMarking->sMmcoRef[iIdx].iDiffOfPicNum = 1 + uiCode;
kpRefMarking->sMmcoRef[iIdx].iShortFrameNum = (pSh->iFrameNum - kpRefMarking->sMmcoRef[iIdx].iDiffOfPicNum) & (( kpRefMarking->sMmcoRef[iIdx].iShortFrameNum = (pSh->iFrameNum - kpRefMarking->sMmcoRef[iIdx].iDiffOfPicNum) & ((
1 << pSps->uiLog2MaxFrameNum) - 1); 1 << pSps->uiLog2MaxFrameNum) - 1);
} else if (kiMmco == MMCO_LONG2UNUSED) { } else if (kuiMmco == MMCO_LONG2UNUSED) {
WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //long_term_pic_num WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //long_term_pic_num
kpRefMarking->sMmcoRef[iIdx].uiLongTermPicNum = uiCode; kpRefMarking->sMmcoRef[iIdx].uiLongTermPicNum = uiCode;
} }
if (kiMmco == MMCO_SHORT2LONG || kiMmco == MMCO_LONG) { if (kuiMmco == MMCO_SHORT2LONG || kuiMmco == MMCO_LONG) {
WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //long_term_frame_idx WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //long_term_frame_idx
kpRefMarking->sMmcoRef[iIdx].iLongTermFrameIdx = uiCode; kpRefMarking->sMmcoRef[iIdx].iLongTermFrameIdx = uiCode;
} else if (kiMmco == MMCO_SET_MAX_LONG) { } else if (kuiMmco == MMCO_SET_MAX_LONG) {
WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //max_long_term_frame_idx_plus1 WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //max_long_term_frame_idx_plus1
kpRefMarking->sMmcoRef[iIdx].iMaxLongTermFrameIdx = -1 + uiCode; kpRefMarking->sMmcoRef[iIdx].iMaxLongTermFrameIdx = -1 + uiCode;
} }
@ -690,6 +690,8 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co
// first_mb_in_slice // first_mb_in_slice
WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //first_mb_in_slice WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //first_mb_in_slice
WELS_CHECK_SE_UPPER_ERROR (uiCode, 36863u, "first_mb_in_slice", GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER,
ERR_INFO_INVALID_FIRST_MB_IN_SLICE));
pSliceHead->iFirstMbInSlice = uiCode; pSliceHead->iFirstMbInSlice = uiCode;
WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //slice_type WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //slice_type
@ -721,13 +723,10 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co
pSliceHead->eSliceType = static_cast <EWelsSliceType> (uiSliceType); pSliceHead->eSliceType = static_cast <EWelsSliceType> (uiSliceType);
WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //pic_parameter_set_id WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //pic_parameter_set_id
WELS_CHECK_SE_UPPER_ERROR (uiCode, MAX_PPS_COUNT, "iPpsId out of range", GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER,
ERR_INFO_PPS_ID_OVERFLOW));
iPpsId = uiCode; iPpsId = uiCode;
if (iPpsId >= MAX_PPS_COUNT) {
WelsLog (pLogCtx, WELS_LOG_WARNING, "iPpsId out of range");
return GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_PPS_ID_OVERFLOW);
}
//add check PPS available here //add check PPS available here
if (pCtx->bPpsAvailFlags[iPpsId] == false) { if (pCtx->bPpsAvailFlags[iPpsId] == false) {
pCtx->sDecoderStatistics.iPpsReportErrorNum++; pCtx->sDecoderStatistics.iPpsReportErrorNum++;
@ -939,9 +938,8 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co
if (pPps->bEntropyCodingModeFlag) { if (pPps->bEntropyCodingModeFlag) {
if (pSliceHead->eSliceType != I_SLICE && pSliceHead->eSliceType != SI_SLICE) { if (pSliceHead->eSliceType != I_SLICE && pSliceHead->eSliceType != SI_SLICE) {
WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); WELS_READ_VERIFY (BsGetUe (pBs, &uiCode));
WELS_CHECK_SE_UPPER_ERROR (uiCode, SLICE_HEADER_CABAC_INIT_IDC_MAX, "cabac_init_idc", ERR_INFO_INVALID_CABAC_INIT_IDC);
pSliceHead->iCabacInitIdc = uiCode; pSliceHead->iCabacInitIdc = uiCode;
WELS_CHECK_SE_UPPER_ERROR (pSliceHead->iCabacInitIdc, SLICE_HEADER_CABAC_INIT_IDC_MAX, "cabac_init_idc",
ERR_INFO_INVALID_CABAC_INIT_IDC);
} else } else
pSliceHead->iCabacInitIdc = 0; pSliceHead->iCabacInitIdc = 0;
} }