vp10: disallow coding zero-sized tiles-in-frame/frames-in-superframe.

See issue 1088.

Ronald S. Bultje committed 11 years ago

Commit dec44051 parent 9897e1c4 files · +13 −6Browse files

Unified · Split

4 files

@@ -1448,9 +1448,9 @@ static void get_tile_buffer(const uint8_t *const data_end, · 1447 unmodified lines
1448	1448	if (decrypt_cb) {
1449	1449	uint8_t be_data[4];
1450	1450	decrypt_cb(decrypt_state, *data, be_data, tile_sz_mag + 1);
1451		− size = mem_get_varsize(be_data, tile_sz_mag);
	1451	+ size = mem_get_varsize(be_data, tile_sz_mag) + CONFIG_MISC_FIXES;
1452	1452	} else {
1453		− size = mem_get_varsize(*data, tile_sz_mag);
	1453	+ size = mem_get_varsize(*data, tile_sz_mag) + CONFIG_MISC_FIXES;
1454	1454	}
1455	1455	*data += tile_sz_mag + 1;
1456	1456

@@ -506,6 +506,7 @@ vpx_codec_err_t vp10_parse_superframe_index(const uint8_t *data, · 505 unmodified lines
506	506
507	507	for (j = 0; j < mag; ++j)
508	508	this_sz \|= (x++) << (j 8);
	509	+ this_sz += CONFIG_MISC_FIXES;
509	510	sizes[i] = this_sz;
510	511	#if CONFIG_MISC_FIXES
511	512	frame_sz_sum += this_sz;

@@ -1117,9 +1117,13 @@ static size_t encode_tiles(VP10_COMP cpi, uint8_t data_ptr, · 1116 unmodified lines
1117	1117	assert(tok == tok_end);
1118	1118	vpx_stop_encode(&residual_bc);
1119	1119	if (tile_col < tile_cols - 1 \|\| tile_row < tile_rows - 1) {
	1120	+ unsigned int tile_sz;
	1121	+
1120	1122	// size of this tile
1121		− mem_put_le32(data_ptr + total_size, residual_bc.pos);
1122		− max_tile = max_tile > residual_bc.pos ? max_tile : residual_bc.pos;
	1123	+ assert(residual_bc.pos > 0);
	1124	+ tile_sz = residual_bc.pos - CONFIG_MISC_FIXES;
	1125	+ mem_put_le32(data_ptr + total_size, tile_sz);
	1126	+ max_tile = max_tile > tile_sz ? max_tile : tile_sz;
1123	1127	total_size += 4;
1124	1128	}
1125	1129

@@ -795,7 +795,7 @@ static int write_superframe_index(vpx_codec_alg_priv_t *ctx) { · 794 unmodified lines
795	795	marker \|= ctx->pending_frame_count - 1;
796	796	#if CONFIG_MISC_FIXES
797	797	for (i = 0; i < ctx->pending_frame_count - 1; i++) {
798		− const size_t frame_sz = (unsigned int) ctx->pending_frame_sizes[i];
	798	+ const size_t frame_sz = (unsigned int) ctx->pending_frame_sizes[i] - 1;
799	799	max_frame_sz = frame_sz > max_frame_sz ? frame_sz : max_frame_sz;
800	800	}
801	801	#endif
@@ -836,8 +836,10 @@ static int write_superframe_index(vpx_codec_alg_priv_t *ctx) { · 34 unmodified lines
836	836
837	837	*x++ = marker;
838	838	for (i = 0; i < ctx->pending_frame_count - CONFIG_MISC_FIXES; i++) {
839		− unsigned int this_sz = (unsigned int)ctx->pending_frame_sizes[i];
	839	+ unsigned int this_sz;
840	840
	841	+ assert(ctx->pending_frame_sizes[i] > 0);
	842	+ this_sz = (unsigned int)ctx->pending_frame_sizes[i] - CONFIG_MISC_FIXES;
841	843	for (j = 0; j <= mag; j++) {
842	844	*x++ = this_sz & 0xff;
843	845	this_sz >>= 8;

Keyboard shortcuts