This makes the SPS parsing a little, but barely, safer.
Unified · Split
| @@ -199,12 +199,15 @@ int ff_hevc_decode_short_term_rps(HEVCContext *s, ShortTermRPS *rps, · 198 unmodified lines | ||
| 199 | 199 | } |
| 200 | 200 | |
| 201 | 201 | |
| 202 | −static void decode_profile_tier_level(HEVCContext *s, PTLCommon *ptl) | |
| 202 | +static int decode_profile_tier_level(HEVCContext *s, PTLCommon *ptl) | |
| 203 | 203 | { |
| 204 | 204 | int i; |
| 205 | 205 | HEVCLocalContext *lc = s->HEVClc; |
| 206 | 206 | GetBitContext *gb = &lc->gb; |
| 207 | 207 | |
| 208 | + if (get_bits_left(gb) < 2+1+5 + 32 + 4 + 16 + 16 + 12) | |
| 209 | + return -1; | |
| 210 | + | |
| 208 | 211 | ptl->profile_space = get_bits(gb, 2); |
| 209 | 212 | ptl->tier_flag = get_bits1(gb); |
| 210 | 213 | ptl->profile_idc = get_bits(gb, 5); |
| @@ -229,29 +232,49 @@ static void decode_profile_tier_level(HEVCContext *s, PTLCommon *ptl) · 18 unmodified lines | ||
| 229 | 232 | skip_bits(gb, 16); // XXX_reserved_zero_44bits[0..15] |
| 230 | 233 | skip_bits(gb, 16); // XXX_reserved_zero_44bits[16..31] |
| 231 | 234 | skip_bits(gb, 12); // XXX_reserved_zero_44bits[32..43] |
| 235 | + | |
| 236 | + return 0; | |
| 232 | 237 | } |
| 233 | 238 | |
| 234 | −static void parse_ptl(HEVCContext *s, PTL *ptl, int max_num_sub_layers) | |
| 239 | +static int parse_ptl(HEVCContext *s, PTL *ptl, int max_num_sub_layers) | |
| 235 | 240 | { |
| 236 | 241 | int i; |
| 237 | 242 | HEVCLocalContext *lc = s->HEVClc; |
| 238 | 243 | GetBitContext *gb = &lc->gb; |
| 239 | − decode_profile_tier_level(s, &ptl->general_ptl); | |
| 244 | + if (decode_profile_tier_level(s, &ptl->general_ptl) < 0 || | |
| 245 | + get_bits_left(gb) < 8 + 8*2) { | |
| 246 | + av_log(s->avctx, AV_LOG_ERROR, "PTL information too short\n"); | |
| 247 | + return -1; | |
| 248 | + } | |
| 249 | + | |
| 240 | 250 | ptl->general_ptl.level_idc = get_bits(gb, 8); |
| 241 | 251 | |
| 242 | 252 | for (i = 0; i < max_num_sub_layers - 1; i++) { |
| 243 | 253 | ptl->sub_layer_profile_present_flag[i] = get_bits1(gb); |
| 244 | 254 | ptl->sub_layer_level_present_flag[i] = get_bits1(gb); |
| 245 | 255 | } |
| 256 | + | |
| 246 | 257 | if (max_num_sub_layers - 1> 0) |
| 247 | 258 | for (i = max_num_sub_layers - 1; i < 8; i++) |
| 248 | 259 | skip_bits(gb, 2); // reserved_zero_2bits[i] |
| 249 | 260 | for (i = 0; i < max_num_sub_layers - 1; i++) { |
| 250 | − if (ptl->sub_layer_profile_present_flag[i]) | |
| 251 | − decode_profile_tier_level(s, &ptl->sub_layer_ptl[i]); | |
| 252 | − if (ptl->sub_layer_level_present_flag[i]) | |
| 253 | − ptl->sub_layer_ptl[i].level_idc = get_bits(gb, 8); | |
| 261 | + if (ptl->sub_layer_profile_present_flag[i] && | |
| 262 | + decode_profile_tier_level(s, &ptl->sub_layer_ptl[i]) < 0) { | |
| 263 | + av_log(s->avctx, AV_LOG_ERROR, | |
| 264 | + "PTL information for sublayer %i too short\n", i); | |
| 265 | + return -1; | |
| 266 | + } | |
| 267 | + if (ptl->sub_layer_level_present_flag[i]) { | |
| 268 | + if (get_bits_left(gb) < 8) { | |
| 269 | + av_log(s->avctx, AV_LOG_ERROR, | |
| 270 | + "Not enough data for sublayer %i level_idc\n", i); | |
| 271 | + return -1; | |
| 272 | + } else | |
| 273 | + ptl->sub_layer_ptl[i].level_idc = get_bits(gb, 8); | |
| 274 | + } | |
| 254 | 275 | } |
| 276 | + | |
| 277 | + return 0; | |
| 255 | 278 | } |
| 256 | 279 | |
| 257 | 280 | static void decode_sublayer_hrd(HEVCContext *s, unsigned int nb_cpb, |
| @@ -375,7 +398,8 @@ int ff_hevc_decode_nal_vps(HEVCContext *s) · 117 unmodified lines | ||
| 375 | 398 | goto err; |
| 376 | 399 | } |
| 377 | 400 | |
| 378 | − parse_ptl(s, &vps->ptl, vps->vps_max_sub_layers); | |
| 401 | + if (parse_ptl(s, &vps->ptl, vps->vps_max_sub_layers) < 0) | |
| 402 | + goto err; | |
| 379 | 403 | |
| 380 | 404 | vps->vps_sub_layer_ordering_info_present_flag = get_bits1(gb); |
| 381 | 405 | |
| @@ -692,7 +716,8 @@ int ff_hevc_decode_nal_sps(HEVCContext *s) · 310 unmodified lines | ||
| 692 | 716 | |
| 693 | 717 | skip_bits1(gb); // temporal_id_nesting_flag |
| 694 | 718 | |
| 695 | − parse_ptl(s, &sps->ptl, sps->max_sub_layers); | |
| 719 | + if (parse_ptl(s, &sps->ptl, sps->max_sub_layers) < 0) | |
| 720 | + goto err; | |
| 696 | 721 | |
| 697 | 722 | sps_id = get_ue_golomb_long(gb); |
| 698 | 723 | if (sps_id >= MAX_SPS_COUNT) { |