generic-library/openh264
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

fix 960932 by add boundary checks on run_before

Browse Source
This commit is contained in:
Licai Guo 2014-01-19 22:15:25 -08:00
parent 7d6035d5d4
commit a2164c22af
2 changed files with 9 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
codec/decoder/core/inc/error_code.h
View File

@ -116,8 +116,9 @@ ERR_INFO_INVALID_REF_INDEX,
ERR_INFO_INVALID_CBP,
ERR_INFO_DQUANT_OUT_OF_RANGE,
ERR_INFO_CAVLC_INVALID_PREFIX,
ERR_INFO_CAVLC_INVALID_TOTAL_COEFF,
ERR_INFO_CAVLC_INVALID_TOTAL_COEFF_OR_TRAILING_ONES,
ERR_INFO_CAVLC_INVALID_ZERO_LEFT,
ERR_INFO_CAVLC_INVALID_RUN_BEFORE,
ERR_INFO_MV_OUT_OF_RANGE,
ERR_INFO_INVALID_I4x4_PRED_MODE,

16
codec/decoder/core/src/parse_mb_syn_cavlc.cpp
View File

@ -586,8 +586,6 @@ static int32_t CavlcGetLevelVal (int32_t iLevel[16], SReadBitsCache* pBitsCache,
if (iSuffixLengthSize > 0) {
if (pBitsCache->uiRemainBits <= iSuffixLengthSize) SHIFT_BUFFER (pBitsCache);
if (pBitsCache->uiRemainBits <= iSuffixLengthSize)
return 0;
iLevelCode += (pBitsCache->uiCache32Bit >> (32 - iSuffixLengthSize));
POP_BUFFER (pBitsCache, iSuffixLengthSize);
iUsedBits += iSuffixLengthSize;
@ -628,8 +626,6 @@ static int32_t CavlcGetTotalZeros (int32_t& iZerosLeft, SReadBitsCache* pBitsCac
iCount = kpBitNumMap[iTotalZeroVlcIdx - 1];
if (pBitsCache->uiRemainBits < iCount) SHIFT_BUFFER (
pBitsCache); // if uiRemainBits+16 still smaller than iCount?? potential bug
if (pBitsCache->uiRemainBits < iCount)
return 0;
uiValue = pBitsCache->uiCache32Bit >> (32 - iCount);
iCount = pVlcTable->kpTotalZerosTable[uiTableType][iTotalZeroVlcIdx - 1][uiValue][1];
POP_BUFFER (pBitsCache, iCount);
@ -647,8 +643,6 @@ static int32_t CavlcGetRunBefore (int32_t iRun[16], SReadBitsCache* pBitsCache,
if (iZerosLeft > 0) {
uiCount = g_kuiZeroLeftBitNumMap[iZerosLeft];
if (pBitsCache->uiRemainBits < uiCount) SHIFT_BUFFER (pBitsCache);
if (pBitsCache->uiRemainBits < uiCount)
return 0;
uiValue = pBitsCache->uiCache32Bit >> (32 - uiCount);
if (iZerosLeft < 7) {
uiCount = pVlcTable->kpZeroTable[iZerosLeft - 1][uiValue][1];
@ -669,6 +663,8 @@ static int32_t CavlcGetRunBefore (int32_t iRun[16], SReadBitsCache* pBitsCache,
iPrefixBits = GetPrefixBits (pBitsCache->uiCache32Bit);
#endif
iRun[i] = iPrefixBits + 6;
if (iRun[i] > iZerosLeft)
return -1;
POP_BUFFER (pBitsCache, iPrefixBits);
iUsedBits += iPrefixBits;
}
@ -740,7 +736,7 @@ int32_t WelsResidualBlockCavlc (SVlcTable* pVlcTable, uint8_t* pNonZeroCountCach
return 0;
}
if (uiTrailingOnes > 3 || uiTotalCoeff > 16) { /////////////////check uiTrailingOnes and uiTotalCoeff
return -1;
return ERR_INFO_CAVLC_INVALID_TOTAL_COEFF_OR_TRAILING_ONES;
}
iUsedBits += CavlcGetLevelVal (iLevel, &sReadBitsCache, uiTotalCoeff, uiTrailingOnes);
@ -753,8 +749,10 @@ int32_t WelsResidualBlockCavlc (SVlcTable* pVlcTable, uint8_t* pNonZeroCountCach
if (iZerosLeft < 0) {
return ERR_INFO_CAVLC_INVALID_ZERO_LEFT;
}
iUsedBits += CavlcGetRunBefore (iRun, &sReadBitsCache, uiTotalCoeff, pVlcTable, iZerosLeft);
if ((i = CavlcGetRunBefore (iRun, &sReadBitsCache, uiTotalCoeff, pVlcTable, iZerosLeft)) == -1) {
return ERR_INFO_CAVLC_INVALID_RUN_BEFORE;
}
iUsedBits += i;
pBs->iIndex += iUsedBits;
iCoeffNum = -1;