History

Merge pull request #298 from licaiguo/decoder-syntax-element-step1

add decoder syntax checks

huili2 committed 12 years ago

Commit 0fcd0662 parents 413b301 61b64195 files · +261 −40Browse files

Showing the changes to codec/decoder (5 of 5 files). Show all

Unified · Split

5 files
  1. codec/decoder/core/inc/dec_golomb.h +89 −0
  2. codec/decoder/core/inc/error_code.h +14 −0
  3. codec/decoder/core/src/au_parser.cpp +98 −22
  4. codec/decoder/core/src/decoder_core.cpp +45 −7
  5. codec/decoder/core/src/parse_mb_syn_cavlc.cpp +15 −11
codec/decoder/core/inc/dec_golomb.h+89−0
@@ -211,6 +211,95 @@ do { · 210 unmodified lines
211211
212212 return 0;
213213 }
214+//define macros to check syntax elements
215+#define WELS_CHECK_SE_BOTH_ERROR(val, lower_bound, upper_bound, syntax_name, ret_code) do {\
216+if ((val < lower_bound) || (val > upper_bound)) {\
217+ WelsLog(pCtx, WELS_LOG_ERROR, "invalid syntax " syntax_name " %d\n", val);\
218+ return ret_code;\
219+}\
220+}while(0)
221+
222+#define WELS_CHECK_SE_LOWER_ERROR(val, lower_bound, syntax_name, ret_code) do {\
223+if (val < lower_bound) {\
224+ WelsLog(pCtx, WELS_LOG_ERROR, "invalid syntax " syntax_name " %d\n", val);\
225+ return ret_code;\
226+}\
227+}while(0)
228+
229+#define WELS_CHECK_SE_UPPER_ERROR(val, upper_bound, syntax_name, ret_code) do {\
230+if (val > upper_bound) {\
231+ WelsLog(pCtx, WELS_LOG_ERROR, "invalid syntax " syntax_name " %d\n", val);\
232+ return ret_code;\
233+}\
234+}while(0)
235+
236+#define WELS_CHECK_SE_BOTH_ERROR_NOLOG(val, lower_bound, upper_bound, syntax_name, ret_code) do {\
237+if ((val < lower_bound) || (val > upper_bound)) {\
238+ return ret_code;\
239+}\
240+}while(0)
241+
242+#define WELS_CHECK_SE_LOWER_ERROR_NOLOG(val, lower_bound, syntax_name, ret_code) do {\
243+if (val < lower_bound) {\
244+ return ret_code;\
245+}\
246+}while(0)
247+
248+#define WELS_CHECK_SE_UPPER_ERROR_NOLOG(val, upper_bound, syntax_name, ret_code) do {\
249+if (val > upper_bound) {\
250+ return ret_code;\
251+}\
252+}while(0)
253+
254+
255+#define WELS_CHECK_SE_BOTH_WARNING(val, lower_bound, upper_bound, syntax_name) do {\
256+if ((val < lower_bound) || (val > upper_bound)) {\
257+ WelsLog(pCtx, WELS_LOG_WARNING, "invalid syntax " syntax_name " %d\n", val);\
258+}\
259+}while(0)
260+
261+#define WELS_CHECK_SE_LOWER_WARNING(val, lower_bound, syntax_name) do {\
262+if (val < lower_bound) {\
263+ WelsLog(pCtx, WELS_LOG_WARNING, "invalid syntax " syntax_name " %d\n", val);\
264+}\
265+}while(0)
266+
267+#define WELS_CHECK_SE_UPPER_WARNING(val, upper_bound, syntax_name) do {\
268+if (val > upper_bound) {\
269+ WelsLog(pCtx, WELS_LOG_WARNING, "invalid syntax " syntax_name " %d\n", val);\
270+}\
271+}while(0)
272+// below define syntax element offset
273+// for bit_depth_luma_minus8 and bit_depth_chroma_minus8
274+#define BIT_DEPTH_LUMA_OFFSET 8
275+#define BIT_DEPTH_CHROMA_OFFSET 8
276+// for log2_max_frame_num_minus4
277+#define LOG2_MAX_FRAME_NUM_OFFSET 4
278+// for log2_max_pic_order_cnt_lsb_minus4
279+#define LOG2_MAX_PIC_ORDER_CNT_LSB_OFFSET 4
280+// for pic_width_in_mbs_minus1
281+#define PIC_WIDTH_IN_MBS_OFFSET 1
282+// for pic_height_in_map_units_minus1
283+#define PIC_HEIGHT_IN_MAP_UNITS_OFFSET 1
284+// for bit_depth_aux_minus8
285+#define BIT_DEPTH_AUX_OFFSET 8
286+// for num_slice_groups_minus1
287+#define NUM_SLICE_GROUPS_OFFSET 1
288+// for run_length_minus1
289+#define RUN_LENGTH_OFFSET 1
290+// for slice_group_change_rate_minus1
291+#define SLICE_GROUP_CHANGE_RATE_OFFSET 1
292+// for pic_size_in_map_units_minus1
293+#define PIC_SIZE_IN_MAP_UNITS_OFFSET 1
294+// for num_ref_idx_l0_default_active_minus1 and num_ref_idx_l1_default_active_minus1
295+#define NUM_REF_IDX_L0_DEFAULT_ACTIVE_OFFSET 1
296+#define NUM_REF_IDX_L1_DEFAULT_ACTIVE_OFFSET 1
297+// for pic_init_qp_minus26 and pic_init_qs_minus26
298+#define PIC_INIT_QP_OFFSET 26
299+#define PIC_INIT_QS_OFFSET 26
300+// for num_ref_idx_l0_active_minus1 and num_ref_idx_l1_active_minus1
301+#define NUM_REF_IDX_L0_ACTIVE_OFFSET 1
302+#define NUM_REF_IDX_L1_ACTIVE_OFFSET 1
214303
215304 } // namespace WelsDec
216305
codec/decoder/core/inc/error_code.h+14−0
@@ -99,14 +99,28 @@ ERR_INFO_PPS_ID_OVERFLOW, · 98 unmodified lines
9999 ERR_INFO_INVALID_PROFILE_IDC,
100100 ERR_INFO_UNMATCHED_LEVEL_IDC,
101101 ERR_INFO_INVALID_POC_TYPE,
102+ERR_INFO_INVALID_MB_SIZE_INFO,
102103 ERR_INFO_REF_COUNT_OVERFLOW,
103104 ERR_INFO_CROPPING_NO_SUPPORTED,
104105 ERR_INFO_INVALID_SLICEGROUP,
105106 ERR_INFO_INVALID_SLICEGROUP_MAP_TYPE,
106107 ERR_INFO_INVALID_FRAME_NUM,
108+ERR_INFO_INVALID_IDR_PIC_ID,
109+ERR_INFO_INVALID_REDUNDANT_PIC_CNT,
110+ERR_INFO_INVALID_MAX_NUM_REF_FRAMES,
111+ERR_INFO_INVALID_FIRST_MB_IN_SLICE,
112+ERR_INFO_INVALID_NUM_REF_IDX_L0_ACTIVE_MINUS1,
113+ERR_INFO_INVALID_SLICE_ALPHA_C0_OFFSET_DIV2,
114+ERR_INFO_INVALID_SLICE_BETA_OFFSET_DIV2,
107115 ERR_INFO_FMO_INIT_FAIL,
108116 ERR_INFO_SLICE_TYPE_OVERFLOW,
109117 ERR_INFO_INVALID_QP,
118+ERR_INFO_INVALID_PIC_INIT_QS,
119+ERR_INFO_INVALID_CHROMA_QP_INDEX_OFFSET,
120+ERR_INFO_INVALID_PIC_INIT_QP,
121+ERR_INFO_INVALID_LOG2_MAX_FRAME_NUM_MINUS4,
122+ERR_INFO_INVALID_LOG2_MAX_PIC_ORDER_CNT_LSB_MINUS4,
123+ERR_INFO_INVALID_NUM_REF_FRAME_IN_PIC_ORDER_CNT_CYCLE,
110124 ERR_INFO_INVALID_DBLOCKING_IDC,
111125 ERR_INFO_INVALID_MB_TYPE,
112126 ERR_INFO_INVALID_SUB_MB_TYPE,
codec/decoder/core/src/au_parser.cpp+98−22
@@ -600,6 +600,17 @@ void ParsePrefixNalUnit (PWelsDecoderContext pCtx, PBitStringAux pBs) { · 599 unmodified lines
600600 }
601601 }
602602
603+#define SUBSET_SPS_SEQ_SCALED_REF_LAYER_LEFT_OFFSET_MIN -32768
604+#define SUBSET_SPS_SEQ_SCALED_REF_LAYER_LEFT_OFFSET_MAX 32767
605+#define SUBSET_SPS_SEQ_SCALED_REF_LAYER_TOP_OFFSET_MIN -32768
606+#define SUBSET_SPS_SEQ_SCALED_REF_LAYER_TOP_OFFSET_MAX 32767
607+#define SUBSET_SPS_SEQ_SCALED_REF_LAYER_RIGHT_OFFSET_MIN -32768
608+#define SUBSET_SPS_SEQ_SCALED_REF_LAYER_RIGHT_OFFSET_MAX 32767
609+#define SUBSET_SPS_SEQ_SCALED_REF_LAYER_BOTTOM_OFFSET_MIN -32768
610+#define SUBSET_SPS_SEQ_SCALED_REF_LAYER_BOTTOM_OFFSET_MAX 32767
611+
612+
613+
603614
604615 int32_t DecodeSpsSvcExt (PWelsDecoderContext pCtx, PSubsetSps pSpsExt, PBitStringAux pBs) {
605616 PSpsSvcExt pExt = NULL;
@@ -633,9 +644,17 @@ int32_t DecodeSpsSvcExt (PWelsDecoderContext pCtx, PSubsetSps pSpsExt, PBitStrin · 27 unmodified lines
633644 pExt->uiSeqRefLayerChromaPhaseYPlus1 = BsGetBits (pBs, 2);
634645
635646 kpPos->iLeftOffset = BsGetSe (pBs);
647+ WELS_CHECK_SE_BOTH_WARNING (kpPos->iLeftOffset, SUBSET_SPS_SEQ_SCALED_REF_LAYER_LEFT_OFFSET_MIN,
648+ SUBSET_SPS_SEQ_SCALED_REF_LAYER_LEFT_OFFSET_MAX, "seq_scaled_ref_layer_left_offset");
636649 kpPos->iTopOffset = BsGetSe (pBs);
650+ WELS_CHECK_SE_BOTH_WARNING (kpPos->iTopOffset, SUBSET_SPS_SEQ_SCALED_REF_LAYER_TOP_OFFSET_MIN,
651+ SUBSET_SPS_SEQ_SCALED_REF_LAYER_TOP_OFFSET_MAX, "seq_scaled_ref_layer_top_offset");
637652 kpPos->iRightOffset = BsGetSe (pBs);
653+ WELS_CHECK_SE_BOTH_WARNING (kpPos->iRightOffset, SUBSET_SPS_SEQ_SCALED_REF_LAYER_RIGHT_OFFSET_MIN,
654+ SUBSET_SPS_SEQ_SCALED_REF_LAYER_RIGHT_OFFSET_MAX, "seq_scaled_ref_layer_right_offset");
638655 kpPos->iBottomOffset = BsGetSe (pBs);
656+ WELS_CHECK_SE_BOTH_WARNING (kpPos->iBottomOffset, SUBSET_SPS_SEQ_SCALED_REF_LAYER_BOTTOM_OFFSET_MIN,
657+ SUBSET_SPS_SEQ_SCALED_REF_LAYER_BOTTOM_OFFSET_MAX, "seq_scaled_ref_layer_bottom_offset");
639658 }
640659
641660 pExt->bSeqTCoeffLevelPredFlag = !!BsGetOneBit (pBs);
@@ -675,7 +694,7 @@ const SLevelLimits *GetLevelLimits(int32_t iLevelIdx, bool bConstraint3) { · 33 unmodified lines
675694 case 10:
676695 return &g_kSLevelLimits[0];
677696 case 11:
678− if(bConstraint3)
697+ if (bConstraint3)
679698 return &g_kSLevelLimits[1];
680699 else
681700 return &g_kSLevelLimits[2];
@@ -712,6 +731,16 @@ const SLevelLimits *GetLevelLimits(int32_t iLevelIdx, bool bConstraint3) { · 30 unmodified lines
712731 }
713732 return NULL;
714733 }
734+
735+#define SPS_LOG2_MAX_FRAME_NUM_MINUS4_MAX 12
736+#define SPS_LOG2_MAX_PIC_ORDER_CNT_LSB_MINUS4_MAX 12
737+#define SPS_NUM_REF_FRAMES_IN_PIC_ORDER_CNT_CYCLE_MAX 255
738+#define SPS_MAX_NUM_REF_FRAMES_MAX 16
739+#define PPS_PIC_INIT_QP_QS_MIN 0
740+#define PPS_PIC_INIT_QP_QS_MAX 51
741+#define PPS_CHROMA_QP_INDEX_OFFSET_MIN -12
742+#define PPS_CHROMA_QP_INDEX_OFFSET_MAX 12
743+
715744 /*!
716745 *************************************************************************************
717746 * \brief to parse Sequence Parameter Set (SPS)
@@ -728,7 +757,6 @@ const SLevelLimits *GetLevelLimits(int32_t iLevelIdx, bool bConstraint3) { · 10 unmodified lines
728757 *************************************************************************************
729758 */
730759
731−
732760 int32_t ParseSps (PWelsDecoderContext pCtx, PBitStringAux pBsAux, int32_t* pPicWidth, int32_t* pPicHeight) {
733761 PBitStringAux pBs = pBsAux;
734762 PSps pSps = NULL;
@@ -737,10 +765,10 @@ int32_t ParseSps (PWelsDecoderContext pCtx, PBitStringAux pBsAux, int32_t* pPicW · 2 unmodified lines
737765 ProfileIdc uiProfileIdc;
738766 uint8_t uiLevelIdc;
739767 int32_t iSpsId;
768+ uint32_t uiTmp;
740769 bool bConstraintSetFlags[6] = { false };
741770 const bool kbUseSubsetFlag = IS_SUBSET_SPS_NAL (pNalHead->eNalUnitType);
742771
743−
744772 if (kbUseSubsetFlag) { // SubsetSps
745773 pCtx->bSubspsExistAheadFlag = true;
746774 } else { // Sps
@@ -799,12 +827,11 @@ int32_t ParseSps (PWelsDecoderContext pCtx, PBitStringAux pBsAux, int32_t* pPicW · 52 unmodified lines
799827 pCtx->bSpsAvailFlags[iSpsId] = true; // added for EC, 10/28/2009
800828 #endif //MOSAIC_AVOID_BASED_ON_SPS_PPS_ID
801829 }
802− const SLevelLimits *pSLevelLimits = GetLevelLimits(uiLevelIdc, bConstraintSetFlags[3]);
830+ const SLevelLimits* pSLevelLimits = GetLevelLimits (uiLevelIdc, bConstraintSetFlags[3]);
803831 if (NULL == pSLevelLimits) {
804− WelsLog (pCtx, WELS_LOG_WARNING, "ParseSps(): level_idx (%d).\n", uiLevelIdc);
805− return GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_UNSUPPORTED_NON_BASELINE);
806− }
807− else pSps->pSLevelLimits = pSLevelLimits;
832+ WelsLog (pCtx, WELS_LOG_WARNING, "ParseSps(): level_idx (%d).\n", uiLevelIdc);
833+ return GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_UNSUPPORTED_NON_BASELINE);
834+ } else pSps->pSLevelLimits = pSLevelLimits;
808835 // syntax elements in default
809836 pSps->uiChromaFormatIdc = 1;
810837 pSps->uiBitDepthLuma =
@@ -845,19 +872,29 @@ int32_t ParseSps (PWelsDecoderContext pCtx, PBitStringAux pBsAux, int32_t* pPicW · 34 unmodified lines
845872 return GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_UNSUPPORTED_NON_BASELINE);
846873 }
847874 }
848−
849− pSps->uiLog2MaxFrameNum = 4 + BsGetUe (pBs); // log2_max_frame_num_minus4
875+ uiTmp = BsGetUe (pBs);
876+ WELS_CHECK_SE_UPPER_ERROR (uiTmp, SPS_LOG2_MAX_FRAME_NUM_MINUS4_MAX, "log2_max_frame_num_minus4",
877+ GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_INVALID_LOG2_MAX_FRAME_NUM_MINUS4));
878+ pSps->uiLog2MaxFrameNum = LOG2_MAX_FRAME_NUM_OFFSET + uiTmp; // log2_max_frame_num_minus4
850879 pSps->uiPocType = BsGetUe (pBs); // pic_order_cnt_type
851880
852881 if (0 == pSps->uiPocType) {
853− pSps->iLog2MaxPocLsb = 4 + BsGetUe (pBs); // log2_max_pic_order_cnt_lsb_minus4
882+ uiTmp = BsGetUe (pBs);
883+ // log2_max_pic_order_cnt_lsb_minus4 should be in range 0 to 12, inclusive. (sec. 7.4.3)
884+ WELS_CHECK_SE_UPPER_ERROR (uiTmp, SPS_LOG2_MAX_PIC_ORDER_CNT_LSB_MINUS4_MAX, "log2_max_pic_order_cnt_lsb_minus4",
885+ GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_INVALID_LOG2_MAX_PIC_ORDER_CNT_LSB_MINUS4));
886+ pSps->iLog2MaxPocLsb = LOG2_MAX_PIC_ORDER_CNT_LSB_OFFSET + uiTmp; // log2_max_pic_order_cnt_lsb_minus4
854887
855888 } else if (1 == pSps->uiPocType) {
856889 int32_t i;
857890 pSps->bDeltaPicOrderAlwaysZeroFlag = !!BsGetOneBit (pBs); // bDeltaPicOrderAlwaysZeroFlag
858891 pSps->iOffsetForNonRefPic = BsGetSe (pBs); // iOffsetForNonRefPic
859892 pSps->iOffsetForTopToBottomField = BsGetSe (pBs); // iOffsetForTopToBottomField
860− pSps->iNumRefFramesInPocCycle = BsGetUe (pBs); // num_ref_frames_in_pic_order_cnt_cycle
893+ uiTmp = BsGetUe (pBs);
894+ WELS_CHECK_SE_UPPER_ERROR (uiTmp, SPS_NUM_REF_FRAMES_IN_PIC_ORDER_CNT_CYCLE_MAX,
895+ "num_ref_frames_in_pic_order_cnt_cycle", GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS,
896+ ERR_INFO_INVALID_NUM_REF_FRAME_IN_PIC_ORDER_CNT_CYCLE));
897+ pSps->iNumRefFramesInPocCycle = uiTmp; // num_ref_frames_in_pic_order_cnt_cycle
861898 for (i = 0; i < pSps->iNumRefFramesInPocCycle; i++)
862899 pSps->iOffsetForRefFrame[ i ] = BsGetSe (pBs); // iOffsetForRefFrame[ i ]
863900 }
@@ -868,11 +905,39 @@ int32_t ParseSps (PWelsDecoderContext pCtx, PBitStringAux pBsAux, int32_t* pPicW · 4 unmodified lines
868905
869906 pSps->iNumRefFrames = BsGetUe (pBs); // max_num_ref_frames
870907 pSps->bGapsInFrameNumValueAllowedFlag = !!BsGetOneBit (pBs); // bGapsInFrameNumValueAllowedFlag
871− pSps->iMbWidth = 1 + BsGetUe (pBs); // pic_width_in_mbs_minus1
872− pSps->iMbHeight = 1 + BsGetUe (pBs); // pic_height_in_map_units_minus1
908+ uiTmp = BsGetUe (pBs); // pic_width_in_mbs_minus1
909+ if (uiTmp == 0xffffffff) {
910+ WelsLog (pCtx, WELS_LOG_ERROR, " pic_width_in_mbs read error!\n");
911+ return GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_INVALID_MB_SIZE_INFO);
912+ }
913+ pSps->iMbWidth = PIC_WIDTH_IN_MBS_OFFSET + uiTmp;
914+ if ((uint64_t) (pSps->iMbWidth * pSps->iMbWidth) > (8 * pSLevelLimits->iMaxFS)) {
915+ WelsLog (pCtx, WELS_LOG_WARNING, " the pic_width_in_mbs exceeds the level limits!\n");
916+ }
917+ uiTmp = BsGetUe (pBs); // pic_height_in_map_units_minus1
918+ if (uiTmp == 0xffffffff) {
919+ WelsLog (pCtx, WELS_LOG_ERROR, " pic_height_in_mbs read error!\n");
920+ return GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_INVALID_MB_SIZE_INFO);
921+ }
922+ pSps->iMbHeight = PIC_HEIGHT_IN_MAP_UNITS_OFFSET + uiTmp;
923+ if ((uint64_t) (pSps->iMbHeight * pSps->iMbHeight) > (8 * pSLevelLimits->iMaxFS)) {
924+ WelsLog (pCtx, WELS_LOG_WARNING, " the pic_height_in_mbs exceeds the level limits!\n");
925+ }
873926 pSps->uiTotalMbCount = pSps->iMbWidth * pSps->iMbHeight;
927+ if (pSps->uiTotalMbCount > (uint32_t)pSLevelLimits->iMaxFS) {
928+ WelsLog (pCtx, WELS_LOG_WARNING, " the total count of mb exceeds the level limits!\n");
929+ }
930+ WELS_CHECK_SE_UPPER_ERROR (pSps->iNumRefFrames, SPS_MAX_NUM_REF_FRAMES_MAX, "max_num_ref_frames",
931+ GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_INVALID_MAX_NUM_REF_FRAMES));
932+ // here we check max_num_ref_frames
933+ uint32_t uiMaxDpbMbs = pSLevelLimits->iMaxDPBMbs;
934+ uint32_t uiMaxDpbFrames = uiMaxDpbMbs / pSps->uiTotalMbCount;
935+ if (uiMaxDpbFrames > SPS_MAX_NUM_REF_FRAMES_MAX)
936+ uiMaxDpbFrames = SPS_MAX_NUM_REF_FRAMES_MAX;
937+ if ((uint32_t)pSps->iNumRefFrames > uiMaxDpbFrames) {
938+ WelsLog (pCtx, WELS_LOG_WARNING, " max_num_ref_frames exceeds level limits!\n");
939+ }
874940 pSps->bFrameMbsOnlyFlag = !!BsGetOneBit (pBs); // frame_mbs_only_flag
875−
876941 if (!pSps->bFrameMbsOnlyFlag) {
877942 WelsLog (pCtx, WELS_LOG_WARNING, "ParseSps(): frame_mbs_only_flag (%d) not supported.\n", pSps->bFrameMbsOnlyFlag);
878943 return GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_UNSUPPORTED_MBAFF);
@@ -882,8 +947,14 @@ int32_t ParseSps (PWelsDecoderContext pCtx, PBitStringAux pBsAux, int32_t* pPicW · 3 unmodified lines
882947 if (pSps->bFrameCroppingFlag) {
883948 pSps->sFrameCrop.iLeftOffset = BsGetUe (pBs); // frame_crop_left_offset
884949 pSps->sFrameCrop.iRightOffset = BsGetUe (pBs); // frame_crop_right_offset
950+ if ((pSps->sFrameCrop.iLeftOffset + pSps->sFrameCrop.iRightOffset) > ((int32_t)pSps->iMbWidth * 16 / 2)) {
951+ WelsLog (pCtx, WELS_LOG_WARNING, "frame_crop_left_offset + frame_crop_right_offset exceeds limits!\n");
952+ }
885953 pSps->sFrameCrop.iTopOffset = BsGetUe (pBs); // frame_crop_top_offset
886954 pSps->sFrameCrop.iBottomOffset = BsGetUe (pBs); // frame_crop_bottom_offset
955+ if ((pSps->sFrameCrop.iTopOffset + pSps->sFrameCrop.iBottomOffset) > ((int32_t)pSps->iMbHeight * 16 / 2)) {
956+ WelsLog (pCtx, WELS_LOG_WARNING, "frame_crop_top_offset + frame_crop_right_offset exceeds limits!\n");
957+ }
887958 } else {
888959 pSps->sFrameCrop.iLeftOffset = 0; // frame_crop_left_offset
889960 pSps->sFrameCrop.iRightOffset = 0; // frame_crop_right_offset
@@ -957,7 +1028,7 @@ int32_t ParsePps (PWelsDecoderContext pCtx, PPps pPpsList, PBitStringAux pBsAux) · 67 unmodified lines
9571028 pPps->bEntropyCodingModeFlag = !!BsGetOneBit (pBsAux);
9581029 pPps->bPicOrderPresentFlag = !!BsGetOneBit (pBsAux);
9591030
960− pPps->uiNumSliceGroups = 1 + BsGetUe (pBsAux);
1031+ pPps->uiNumSliceGroups = NUM_SLICE_GROUPS_OFFSET + BsGetUe (pBsAux);
9611032
9621033 if (pPps->uiNumSliceGroups > MAX_SLICEGROUP_IDS) {
9631034 return ERR_INFO_INVALID_SLICEGROUP;
@@ -974,7 +1045,7 @@ int32_t ParsePps (PWelsDecoderContext pCtx, PPps pPpsList, PBitStringAux pBsAux) · 10 unmodified lines
9741045 switch (pPps->uiSliceGroupMapType) {
9751046 case 0:
9761047 for (iTmp = 0; iTmp < pPps->uiNumSliceGroups; iTmp++) {
977− pPps->uiRunLength[iTmp] = 1 + BsGetUe (pBsAux);
1048+ pPps->uiRunLength[iTmp] = RUN_LENGTH_OFFSET + BsGetUe (pBsAux);
9781049 }
9791050 break;
9801051 default:
@@ -982,8 +1053,8 @@ int32_t ParsePps (PWelsDecoderContext pCtx, PPps pPpsList, PBitStringAux pBsAux) · 1 unmodified line
9821053 }
9831054 }
9841055
985− pPps->uiNumRefIdxL0Active = 1 + BsGetUe (pBsAux);
986− pPps->uiNumRefIdxL1Active = 1 + BsGetUe (pBsAux);
1056+ pPps->uiNumRefIdxL0Active = NUM_REF_IDX_L0_DEFAULT_ACTIVE_OFFSET + BsGetUe (pBsAux);
1057+ pPps->uiNumRefIdxL1Active = NUM_REF_IDX_L1_DEFAULT_ACTIVE_OFFSET + BsGetUe (pBsAux);
9871058
9881059 if (pPps->uiNumRefIdxL0Active > MAX_REF_PIC_COUNT ||
9891060 pPps->uiNumRefIdxL1Active > MAX_REF_PIC_COUNT) {
@@ -998,10 +1069,15 @@ int32_t ParsePps (PWelsDecoderContext pCtx, PPps pPpsList, PBitStringAux pBsAux) · 8 unmodified lines
9981069 return GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_UNSUPPORTED_WP);
9991070 }
10001071
1001− pPps->iPicInitQp = 26 + BsGetSe (pBsAux);
1002− pPps->iPicInitQs = 26 + BsGetSe (pBsAux);
1003−
1072+ pPps->iPicInitQp = PIC_INIT_QP_OFFSET + BsGetSe (pBsAux);
1073+ WELS_CHECK_SE_BOTH_ERROR (pPps->iPicInitQp, PPS_PIC_INIT_QP_QS_MIN, PPS_PIC_INIT_QP_QS_MAX, "pic_init_qp_minus26 + 26",
1074+ GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_INVALID_PIC_INIT_QP));
1075+ pPps->iPicInitQs = PIC_INIT_QS_OFFSET + BsGetSe (pBsAux);
1076+ WELS_CHECK_SE_BOTH_ERROR (pPps->iPicInitQs, PPS_PIC_INIT_QP_QS_MIN, PPS_PIC_INIT_QP_QS_MAX, "pic_init_qs_minus26 + 26",
1077+ GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_INVALID_PIC_INIT_QS));
10041078 pPps->iChromaQpIndexOffset = BsGetSe (pBsAux);
1079+ WELS_CHECK_SE_BOTH_ERROR (pPps->iChromaQpIndexOffset, PPS_CHROMA_QP_INDEX_OFFSET_MIN, PPS_CHROMA_QP_INDEX_OFFSET_MAX,
1080+ "chroma_qp_index_offset", GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_INVALID_CHROMA_QP_INDEX_OFFSET));
10051081 pPps->bDeblockingFilterControlPresentFlag = !!BsGetOneBit (pBsAux);
10061082 pPps->bConstainedIntraPredFlag = !!BsGetOneBit (pBsAux);
10071083 pPps->bRedundantPicCntPresentFlag = !!BsGetOneBit (pBsAux);
codec/decoder/core/src/decoder_core.cpp+45−7
@@ -155,7 +155,7 @@ int32_t ParseRefPicListReordering (PBitStringAux pBs, PSliceHeader pSh) { · 154 unmodified lines
155155 int32_t iList = 0;
156156 const ESliceType keSt = pSh->eSliceType;
157157 PRefPicListReorderSyn pRefPicListReordering = &pSh->pRefPicListReordering;
158−
158+ PSps pSps = pSh->pSps;
159159 if (keSt == I_SLICE || keSt == SI_SLICE)
160160 return ERR_NONE;
161161
@@ -166,7 +166,7 @@ int32_t ParseRefPicListReordering (PBitStringAux pBs, PSliceHeader pSh) { · 4 unmodified lines
166166 if (pRefPicListReordering->bRefPicListReorderingFlag[iList]) {
167167 int32_t iIdx = 0;
168168 do {
169− const uint8_t kuiIdc = BsGetUe (pBs);
169+ const uint32_t kuiIdc = BsGetUe (pBs);
170170
171171 //Fixed the referrence list reordering crash issue.(fault kIdc value > 3 case)---
172172 if ((iIdx >= MAX_REF_PIC_COUNT) || (kuiIdc > 3)) {
@@ -180,7 +180,12 @@ int32_t ParseRefPicListReordering (PBitStringAux pBs, PSliceHeader pSh) { · 7 unmodified lines
180180 return GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_INVALID_REF_REORDERING);
181181
182182 if (kuiIdc == 0 || kuiIdc == 1) {
183− pRefPicListReordering->sReorderingSyn[iList][iIdx].uiAbsDiffPicNumMinus1 = BsGetUe (pBs); // uiAbsDiffPicNumMinus1
183+ // abs_diff_pic_num_minus1 should be in range 0 to MaxPicNum-1, MaxPicNum is derived as
184+ // 2^(4+log2_max_frame_num_minus4)
185+ uint32_t uiTmp = BsGetUe (pBs);
186+ WELS_CHECK_SE_UPPER_ERROR_NOLOG (uiTmp, (1 << pSps->uiLog2MaxFrameNum), "abs_diff_pic_num_minus1",
187+ GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_INVALID_REF_REORDERING));
188+ pRefPicListReordering->sReorderingSyn[iList][iIdx].uiAbsDiffPicNumMinus1 = uiTmp; // uiAbsDiffPicNumMinus1
184189 } else if (kuiIdc == 2) {
185190 pRefPicListReordering->sReorderingSyn[iList][iIdx].uiLongTermPicNum = BsGetUe (pBs);
186191 }
@@ -199,7 +204,7 @@ int32_t ParseRefPicListReordering (PBitStringAux pBs, PSliceHeader pSh) { · 12 unmodified lines
199204 int32_t ParseDecRefPicMarking (PWelsDecoderContext pCtx, PBitStringAux pBs, PSliceHeader pSh, PSps pSps,
200205 const bool kbIdrFlag) {
201206 PRefPicMarking const kpRefMarking = &pSh->sRefMarking;
202−
207+ PRefPic pRefPic = &pCtx->sRefPic;
203208 if (kbIdrFlag) {
204209 kpRefMarking->bNoOutputOfPriorPicsFlag = !!BsGetOneBit (pBs);
205210 kpRefMarking->bLongTermRefFlag = !!BsGetOneBit (pBs);
@@ -447,6 +452,13 @@ int32_t CheckSpsId (PWelsDecoderContext pCtx, PSubsetSps* ppSubsetSps, PSps* ppS · 241 unmodified lines
447452 }
448453
449454 #endif
455+
456+#define SLICE_HEADER_IDR_PIC_ID_MAX 65535
457+#define SLICE_HEADER_REDUNDANT_PIC_CNT_MAX 127
458+#define SLICE_HEADER_ALPHAC0_BETA_OFFSET_MIN -12
459+#define SLICE_HEADER_ALPHAC0_BETA_OFFSET_MAX 12
460+#define SLICE_HEADER_INTER_LAYER_ALPHAC0_BETA_OFFSET_MIN -12
461+#define SLICE_HEADER_INTER_LAYER_ALPHAC0_BETA_OFFSET_MAX 12
450462 /*
451463 * decode_slice_header_avc
452464 * Parse slice header of bitstream in avc for storing data structure
@@ -465,6 +477,7 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co · 12 unmodified lines
465477 int32_t iRet = ERR_NONE;
466478 uint8_t uiSliceType = 0;
467479 uint8_t uiQualityId = BASE_QUALITY_ID;
480+ uint32_t uiTmp;
468481 bool bIdrFlag = false;
469482 bool bSgChangeCycleInvolved = false; // involved slice group change cycle ?
470483
@@ -489,6 +502,7 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co · 18 unmodified lines
489502
490503 kpCurNal->sNalData.sVclNal.bSliceHeaderExtFlag = kbExtensionFlag;
491504
505+ // first_mb_in_slice
492506 pSliceHead->iFirstMbInSlice = BsGetUe (pBs);
493507
494508 uiSliceType = BsGetUe (pBs);
@@ -500,7 +514,7 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co · 5 unmodified lines
500514 if (uiSliceType > 4)
501515 uiSliceType -= 5;
502516
503− if((eNalType == NAL_UNIT_CODED_SLICE_IDR) && (uiSliceType != 2)){
517+ if ((eNalType == NAL_UNIT_CODED_SLICE_IDR) && (uiSliceType != 2)) {
504518 WelsLog (pCtx, WELS_LOG_WARNING, "Invalid slice type(%d) in IDR picture. \n", uiSliceType);
505519 return GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_INVALID_SLICE_TYPE);
506520 }
@@ -566,6 +580,9 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co · 59 unmodified lines
566580 WelsLog (pCtx, WELS_LOG_WARNING, "non existing SPS referenced\n");
567581 return GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_NO_PARAM_SETS);
568582 }
583+ // check first_mb_in_slice
584+ WELS_CHECK_SE_UPPER_ERROR ((uint32_t) (pSliceHead->iFirstMbInSlice), pSps->uiTotalMbCount, "first_mb_in_slice",
585+ GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_INVALID_FIRST_MB_IN_SLICE));
569586 pSliceHead->iFrameNum = BsGetBits (pBs, pSps->uiLog2MaxFrameNum);
570587
571588 pSliceHead->bFieldPicFlag = false;
@@ -584,7 +601,11 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co · 12 unmodified lines
584601 pSliceHead->iFrameNum);
585602 return GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_INVALID_FRAME_NUM);
586603 }
587− pSliceHead->uiIdrPicId = BsGetUe (pBs); /* uiIdrPicId */
604+ uiTmp = BsGetUe (pBs);
605+ // standard 7.4.3 idr_pic_id should be in range 0 to 65535, inclusive.
606+ WELS_CHECK_SE_UPPER_ERROR (uiTmp, SLICE_HEADER_IDR_PIC_ID_MAX, "idr_pic_id", GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER,
607+ ERR_INFO_INVALID_IDR_PIC_ID));
608+ pSliceHead->uiIdrPicId = uiTmp; /* uiIdrPicId */
588609 #ifdef LONG_TERM_REF
589610 pCtx->uiCurIdrPicId = pSliceHead->uiIdrPicId;
590611 #endif
@@ -606,7 +627,11 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co · 15 unmodified lines
606627
607628 pSliceHead->iRedundantPicCnt = 0;
608629 if (pPps->bRedundantPicCntPresentFlag) {
609− pSliceHead->iRedundantPicCnt = BsGetUe (pBs);
630+ uiTmp = BsGetUe (pBs);
631+ // standard section 7.4.3, redundant_pic_cnt should be in range 0 to 127, inclusive.
632+ WELS_CHECK_SE_UPPER_ERROR (uiTmp, SLICE_HEADER_REDUNDANT_PIC_CNT_MAX, "redundant_pic_cnt",
633+ GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_INVALID_REDUNDANT_PIC_CNT));
634+ pSliceHead->iRedundantPicCnt = uiTmp;
610635 }
611636
612637 //set defaults, might be overriden a few line later
@@ -695,7 +720,13 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co · 82 unmodified lines
695720 }
696721 if (pSliceHead->uiDisableDeblockingFilterIdc != 1) {
697722 pSliceHead->iSliceAlphaC0Offset = BsGetSe (pBs) * 2; // slice_alpha_c0_offset_div2
723+ WELS_CHECK_SE_BOTH_ERROR (pSliceHead->iSliceAlphaC0Offset, SLICE_HEADER_ALPHAC0_BETA_OFFSET_MIN,
724+ SLICE_HEADER_ALPHAC0_BETA_OFFSET_MAX, "slice_alpha_c0_offset_div2 * 2", GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER,
725+ ERR_INFO_INVALID_SLICE_ALPHA_C0_OFFSET_DIV2));
698726 pSliceHead->iSliceBetaOffset = BsGetSe (pBs) * 2; // iSliceBetaOffset
727+ WELS_CHECK_SE_BOTH_ERROR (pSliceHead->iSliceBetaOffset, SLICE_HEADER_ALPHAC0_BETA_OFFSET_MIN,
728+ SLICE_HEADER_ALPHAC0_BETA_OFFSET_MAX, "slice_beta_offset_div2 * 2", GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER,
729+ ERR_INFO_INVALID_SLICE_BETA_OFFSET_DIV2));
699730 }
700731 }
701732
@@ -731,7 +762,14 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co · 29 unmodified lines
731762 }
732763 if (pSliceHeadExt->uiDisableInterLayerDeblockingFilterIdc != 1) {
733764 pSliceHeadExt->iInterLayerSliceAlphaC0Offset = BsGetSe (pBs) << 1;
765+ WELS_CHECK_SE_BOTH_ERROR (pSliceHeadExt->iInterLayerSliceAlphaC0Offset,
766+ SLICE_HEADER_INTER_LAYER_ALPHAC0_BETA_OFFSET_MIN, SLICE_HEADER_INTER_LAYER_ALPHAC0_BETA_OFFSET_MAX,
767+ "inter_layer_alpha_c0_offset_div2 * 2", GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER,
768+ ERR_INFO_INVALID_SLICE_ALPHA_C0_OFFSET_DIV2));
734769 pSliceHeadExt->iInterLayerSliceBetaOffset = BsGetSe (pBs) << 1;
770+ WELS_CHECK_SE_BOTH_ERROR (pSliceHeadExt->iInterLayerSliceBetaOffset, SLICE_HEADER_INTER_LAYER_ALPHAC0_BETA_OFFSET_MIN,
771+ SLICE_HEADER_INTER_LAYER_ALPHAC0_BETA_OFFSET_MAX, "inter_layer_slice_beta_offset_div2 * 2",
772+ GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_INVALID_SLICE_BETA_OFFSET_DIV2));
735773 }
736774 }
737775
codec/decoder/core/src/parse_mb_syn_cavlc.cpp+15−11
@@ -985,6 +985,7 @@ int32_t ParseInterInfo (PWelsDecoderContext pCtx, int16_t iMvArray[LIST_A][30][M · 984 unmodified lines
985985 PBitStringAux pBs) {
986986 PSlice pSlice = &pCtx->pCurDqLayer->sLayerInfo.sSliceInLayer;
987987 PSliceHeader pSliceHeader = &pSlice->sSliceHeaderExt.sSliceHeader;
988+ PPicture* ppRefPic = pCtx->sRefPic.pRefList[LIST_0];
988989 int32_t iNumRefFrames = pSliceHeader->pSps->iNumRefFrames;
989990 int32_t iRefCount[2];
990991 PDqLayer pCurDqLayer = pCtx->pCurDqLayer;
@@ -992,7 +993,8 @@ int32_t ParseInterInfo (PWelsDecoderContext pCtx, int16_t iMvArray[LIST_A][30][M · 1 unmodified line
992993 int32_t iMbXy = pCurDqLayer->iMbXyIndex;
993994 int32_t iMotionPredFlag[4];
994995 int16_t iMv[2] = {0};
995−
996+ int16_t iMinVmv = pSliceHeader->pSps->pSLevelLimits->iMinVmv;
997+ int16_t iMaxVmv = pSliceHeader->pSps->pSLevelLimits->iMaxVmv;
996998 iMotionPredFlag[0] = iMotionPredFlag[1] = iMotionPredFlag[2] = iMotionPredFlag[3] =
997999 pSlice->sSliceHeaderExt.bDefaultMotionPredFlag;
9981000 iRefCount[0] = pSliceHeader->uiRefCount[0];
@@ -1000,13 +1002,15 @@ int32_t ParseInterInfo (PWelsDecoderContext pCtx, int16_t iMvArray[LIST_A][30][M · 1 unmodified line
10001002
10011003 switch (pCurDqLayer->pMbType[iMbXy]) {
10021004 case MB_TYPE_16x16: {
1003− int8_t iRefIdx = 0;
1005+ int32_t iRefIdx = 0;
10041006 if (pSlice->sSliceHeaderExt.bAdaptiveMotionPredFlag) {
10051007 iMotionPredFlag[0] = BsGetOneBit (pBs);
10061008 }
10071009 if (iMotionPredFlag[0] == 0) {
10081010 iRefIdx = BsGetTe0 (pBs, iRefCount[0]);
1009− if (iRefIdx < 0 || iRefIdx >= iNumRefFrames) { //error ref_idx
1011+ // Security check: iRefIdx should be in range 0 to num_ref_idx_l0_active_minus1, includsive
1012+ // ref to standard section 7.4.5.1. iRefCount[0] is 1 + num_ref_idx_l0_active_minus1.
1013+ if ((iRefIdx < 0) || (iRefIdx >= iRefCount[0]) || (ppRefPic[iRefIdx] == NULL)) { //error ref_idx
10101014 return ERR_INFO_INVALID_REF_INDEX;
10111015 }
10121016 } else {
@@ -1017,7 +1021,7 @@ int32_t ParseInterInfo (PWelsDecoderContext pCtx, int16_t iMvArray[LIST_A][30][M · 4 unmodified lines
10171021
10181022 iMv[0] += BsGetSe (pBs);
10191023 iMv[1] += BsGetSe (pBs);
1020−
1024+ WELS_CHECK_SE_BOTH_WARNING (iMv[1], iMinVmv, iMaxVmv, "vertical mv");
10211025 UpdateP16x16MotionInfo (pCurDqLayer, iRefIdx, iMv);
10221026 }
10231027 break;
@@ -1035,7 +1039,7 @@ int32_t ParseInterInfo (PWelsDecoderContext pCtx, int16_t iMvArray[LIST_A][30][M · 11 unmodified lines
10351039 return GENERATE_ERROR_NO (ERR_LEVEL_MB_DATA, ERR_INFO_UNSUPPORTED_ILP);
10361040 }
10371041 iRefIdx[i] = BsGetTe0 (pBs, iRefCount[0]);
1038− if (iRefIdx[i] < 0 || iRefIdx[i] >= iNumRefFrames) { //error ref_idx
1042+ if ((iRefIdx[i] < 0) || (iRefIdx[i] >= iRefCount[0]) || (ppRefPic[iRefIdx[i]] == NULL)) { //error ref_idx
10391043 return ERR_INFO_INVALID_REF_INDEX;
10401044 }
10411045 }
@@ -1044,7 +1048,7 @@ int32_t ParseInterInfo (PWelsDecoderContext pCtx, int16_t iMvArray[LIST_A][30][M · 2 unmodified lines
10441048
10451049 iMv[0] += BsGetSe (pBs);
10461050 iMv[1] += BsGetSe (pBs);
1047−
1051+ WELS_CHECK_SE_BOTH_WARNING (iMv[1], iMinVmv, iMaxVmv, "vertical mv");
10481052 UpdateP16x8MotionInfo (pCurDqLayer, iMvArray, iRefIdxArray, i << 3, iRefIdx[i], iMv);
10491053 }
10501054 }
@@ -1060,7 +1064,7 @@ int32_t ParseInterInfo (PWelsDecoderContext pCtx, int16_t iMvArray[LIST_A][30][M · 9 unmodified lines
10601064 for (i = 0; i < 2; i++) {
10611065 if (iMotionPredFlag[i] == 0) {
10621066 iRefIdx[i] = BsGetTe0 (pBs, iRefCount[0]);
1063− if (iRefIdx[i] < 0 || iRefIdx[i] >= iNumRefFrames) { //error ref_idx
1067+ if ((iRefIdx[i] < 0) || (iRefIdx[i] >= iRefCount[0]) || (ppRefPic[iRefIdx[i]] == NULL)) { //error ref_idx
10641068 return ERR_INFO_INVALID_REF_INDEX;
10651069 }
10661070 } else {
@@ -1074,14 +1078,14 @@ int32_t ParseInterInfo (PWelsDecoderContext pCtx, int16_t iMvArray[LIST_A][30][M · 7 unmodified lines
10741078
10751079 iMv[0] += BsGetSe (pBs);
10761080 iMv[1] += BsGetSe (pBs);
1077−
1081+ WELS_CHECK_SE_BOTH_WARNING (iMv[1], iMinVmv, iMaxVmv, "vertical mv");
10781082 UpdateP8x16MotionInfo (pCurDqLayer, iMvArray, iRefIdxArray, i << 2, iRefIdx[i], iMv);
10791083 }
10801084 }
10811085 break;
10821086 case MB_TYPE_8x8:
10831087 case MB_TYPE_8x8_REF0: {
1084− int8_t iRefIdx[4] = {0}, iSubPartCount[4], iPartWidth[4];
1088+ int32_t iRefIdx[4] = {0}, iSubPartCount[4], iPartWidth[4];
10851089 uint32_t uiSubMbType;
10861090
10871091 if (MB_TYPE_8x8_REF0 == pCurDqLayer->pMbType[iMbXy]) {
@@ -1116,7 +1120,7 @@ int32_t ParseInterInfo (PWelsDecoderContext pCtx, int16_t iMvArray[LIST_A][30][M · 28 unmodified lines
11161120
11171121 if (iMotionPredFlag[i] == 0) {
11181122 iRefIdx[i] = BsGetTe0 (pBs, iRefCount[0]);
1119− if (iRefIdx[i] < 0 || iRefIdx[i] >= iNumRefFrames) { //error ref_idx
1123+ if ((iRefIdx[i] < 0) || (iRefIdx[i] >= iRefCount[0]) || (ppRefPic[iRefIdx[i]] == NULL)) { //error ref_idx
11201124 return ERR_INFO_INVALID_REF_INDEX;
11211125 }
11221126
@@ -1149,7 +1153,7 @@ int32_t ParseInterInfo (PWelsDecoderContext pCtx, int16_t iMvArray[LIST_A][30][M · 26 unmodified lines
11491153
11501154 iMv[0] += BsGetSe (pBs);
11511155 iMv[1] += BsGetSe (pBs);
1152−
1156+ WELS_CHECK_SE_BOTH_WARNING (iMv[1], iMinVmv, iMaxVmv, "vertical mv");
11531157 if (SUB_MB_TYPE_8x8 == uiSubMbType) {
11541158 ST32 (pCurDqLayer->pMv[0][iMbXy][uiScan4Idx], LD32 (iMv));
11551159 ST32 (pCurDqLayer->pMv[0][iMbXy][uiScan4Idx + 1], LD32 (iMv));

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t