This makes the SPS parsing a little, but barely, safer.
Unified · Split
| @@ -199,12 +199,15 @@ int ff_hevc_decode_short_term_rps(HEVCContext *s, ShortTermRPS *rps, · 198 unmodified lines | |||
| 199 | } | 199 | } |
| 200 | 200 | ||
| 201 | 201 | ||
| 202 | static void decode_profile_tier_level(HEVCContext *s, PTLCommon *ptl) | 202 | static int decode_profile_tier_level(HEVCContext *s, PTLCommon *ptl) |
| 203 | { | 203 | { |
| 204 | int i; | 204 | int i; |
| 205 | HEVCLocalContext *lc = s->HEVClc; | 205 | HEVCLocalContext *lc = s->HEVClc; |
| 206 | GetBitContext *gb = &lc->gb; | 206 | GetBitContext *gb = &lc->gb; |
| 207 | 207 | ||
| 208 | if (get_bits_left(gb) < 2+1+5 + 32 + 4 + 16 + 16 + 12) | ||
| 209 | return -1; | ||
| 210 | |||
| 208 | ptl->profile_space = get_bits(gb, 2); | 211 | ptl->profile_space = get_bits(gb, 2); |
| 209 | ptl->tier_flag = get_bits1(gb); | 212 | ptl->tier_flag = get_bits1(gb); |
| 210 | ptl->profile_idc = get_bits(gb, 5); | 213 | ptl->profile_idc = get_bits(gb, 5); |
| @@ -229,29 +232,49 @@ static void decode_profile_tier_level(HEVCContext *s, PTLCommon *ptl) · 18 unmodified lines | |||
| 229 | skip_bits(gb, 16); // XXX_reserved_zero_44bits[0..15] | 232 | skip_bits(gb, 16); // XXX_reserved_zero_44bits[0..15] |
| 230 | skip_bits(gb, 16); // XXX_reserved_zero_44bits[16..31] | 233 | skip_bits(gb, 16); // XXX_reserved_zero_44bits[16..31] |
| 231 | skip_bits(gb, 12); // XXX_reserved_zero_44bits[32..43] | 234 | skip_bits(gb, 12); // XXX_reserved_zero_44bits[32..43] |
| 235 | |||
| 236 | return 0; | ||
| 232 | } | 237 | } |
| 233 | 238 | ||
| 234 | static void parse_ptl(HEVCContext *s, PTL *ptl, int max_num_sub_layers) | 239 | static int parse_ptl(HEVCContext *s, PTL *ptl, int max_num_sub_layers) |
| 235 | { | 240 | { |
| 236 | int i; | 241 | int i; |
| 237 | HEVCLocalContext *lc = s->HEVClc; | 242 | HEVCLocalContext *lc = s->HEVClc; |
| 238 | GetBitContext *gb = &lc->gb; | 243 | GetBitContext *gb = &lc->gb; |
| 239 | decode_profile_tier_level(s, &ptl->general_ptl); | 244 | if (decode_profile_tier_level(s, &ptl->general_ptl) < 0 || |
| 245 | get_bits_left(gb) < 8 + 8*2) { | ||
| 246 | av_log(s->avctx, AV_LOG_ERROR, "PTL information too short\n"); | ||
| 247 | return -1; | ||
| 248 | } | ||
| 249 | |||
| 240 | ptl->general_ptl.level_idc = get_bits(gb, 8); | 250 | ptl->general_ptl.level_idc = get_bits(gb, 8); |
| 241 | 251 | ||
| 242 | for (i = 0; i < max_num_sub_layers - 1; i++) { | 252 | for (i = 0; i < max_num_sub_layers - 1; i++) { |
| 243 | ptl->sub_layer_profile_present_flag[i] = get_bits1(gb); | 253 | ptl->sub_layer_profile_present_flag[i] = get_bits1(gb); |
| 244 | ptl->sub_layer_level_present_flag[i] = get_bits1(gb); | 254 | ptl->sub_layer_level_present_flag[i] = get_bits1(gb); |
| 245 | } | 255 | } |
| 256 | |||
| 246 | if (max_num_sub_layers - 1> 0) | 257 | if (max_num_sub_layers - 1> 0) |
| 247 | for (i = max_num_sub_layers - 1; i < 8; i++) | 258 | for (i = max_num_sub_layers - 1; i < 8; i++) |
| 248 | skip_bits(gb, 2); // reserved_zero_2bits[i] | 259 | skip_bits(gb, 2); // reserved_zero_2bits[i] |
| 249 | for (i = 0; i < max_num_sub_layers - 1; i++) { | 260 | for (i = 0; i < max_num_sub_layers - 1; i++) { |
| 250 | if (ptl->sub_layer_profile_present_flag[i]) | 261 | if (ptl->sub_layer_profile_present_flag[i] && |
| 251 | decode_profile_tier_level(s, &ptl->sub_layer_ptl[i]); | 262 | decode_profile_tier_level(s, &ptl->sub_layer_ptl[i]) < 0) { |
| 252 | if (ptl->sub_layer_level_present_flag[i]) | 263 | av_log(s->avctx, AV_LOG_ERROR, |
| 253 | ptl->sub_layer_ptl[i].level_idc = get_bits(gb, 8); | 264 | "PTL information for sublayer %i too short\n", i); |
| 265 | return -1; | ||
| 266 | } | ||
| 267 | if (ptl->sub_layer_level_present_flag[i]) { | ||
| 268 | if (get_bits_left(gb) < 8) { | ||
| 269 | av_log(s->avctx, AV_LOG_ERROR, | ||
| 270 | "Not enough data for sublayer %i level_idc\n", i); | ||
| 271 | return -1; | ||
| 272 | } else | ||
| 273 | ptl->sub_layer_ptl[i].level_idc = get_bits(gb, 8); | ||
| 274 | } | ||
| 254 | } | 275 | } |
| 276 | |||
| 277 | return 0; | ||
| 255 | } | 278 | } |
| 256 | 279 | ||
| 257 | static void decode_sublayer_hrd(HEVCContext *s, unsigned int nb_cpb, | 280 | static void decode_sublayer_hrd(HEVCContext *s, unsigned int nb_cpb, |
| @@ -375,7 +398,8 @@ int ff_hevc_decode_nal_vps(HEVCContext *s) · 117 unmodified lines | |||
| 375 | goto err; | 398 | goto err; |
| 376 | } | 399 | } |
| 377 | 400 | ||
| 378 | parse_ptl(s, &vps->ptl, vps->vps_max_sub_layers); | 401 | if (parse_ptl(s, &vps->ptl, vps->vps_max_sub_layers) < 0) |
| 402 | goto err; | ||
| 379 | 403 | ||
| 380 | vps->vps_sub_layer_ordering_info_present_flag = get_bits1(gb); | 404 | vps->vps_sub_layer_ordering_info_present_flag = get_bits1(gb); |
| 381 | 405 | ||
| @@ -692,7 +716,8 @@ int ff_hevc_decode_nal_sps(HEVCContext *s) · 310 unmodified lines | |||
| 692 | 716 | ||
| 693 | skip_bits1(gb); // temporal_id_nesting_flag | 717 | skip_bits1(gb); // temporal_id_nesting_flag |
| 694 | 718 | ||
| 695 | parse_ptl(s, &sps->ptl, sps->max_sub_layers); | 719 | if (parse_ptl(s, &sps->ptl, sps->max_sub_layers) < 0) |
| 720 | goto err; | ||
| 696 | 721 | ||
| 697 | sps_id = get_ue_golomb_long(gb); | 722 | sps_id = get_ue_golomb_long(gb); |
| 698 | if (sps_id >= MAX_SPS_COUNT) { | 723 | if (sps_id >= MAX_SPS_COUNT) { |