History

add decoder syntax checks

Licai Guo committed 12 years ago

Commit 61b64191 parent fe766fe5 files · +261 −40Browse files

Showing the changes to codec/decoder/core/src/decoder_core.cpp (1 of 5 files). Show all

Unified · Split

codec/decoder/core/src/decoder_core.cpp+45−7
@@ -155,7 +155,7 @@ int32_t ParseRefPicListReordering (PBitStringAux pBs, PSliceHeader pSh) { · 154 unmodified lines
155155 int32_t iList = 0;
156156 const ESliceType keSt = pSh->eSliceType;
157157 PRefPicListReorderSyn pRefPicListReordering = &pSh->pRefPicListReordering;
158−
158+ PSps pSps = pSh->pSps;
159159 if (keSt == I_SLICE || keSt == SI_SLICE)
160160 return ERR_NONE;
161161
@@ -166,7 +166,7 @@ int32_t ParseRefPicListReordering (PBitStringAux pBs, PSliceHeader pSh) { · 4 unmodified lines
166166 if (pRefPicListReordering->bRefPicListReorderingFlag[iList]) {
167167 int32_t iIdx = 0;
168168 do {
169− const uint8_t kuiIdc = BsGetUe (pBs);
169+ const uint32_t kuiIdc = BsGetUe (pBs);
170170
171171 //Fixed the referrence list reordering crash issue.(fault kIdc value > 3 case)---
172172 if ((iIdx >= MAX_REF_PIC_COUNT) || (kuiIdc > 3)) {
@@ -180,7 +180,12 @@ int32_t ParseRefPicListReordering (PBitStringAux pBs, PSliceHeader pSh) { · 7 unmodified lines
180180 return GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_INVALID_REF_REORDERING);
181181
182182 if (kuiIdc == 0 || kuiIdc == 1) {
183− pRefPicListReordering->sReorderingSyn[iList][iIdx].uiAbsDiffPicNumMinus1 = BsGetUe (pBs); // uiAbsDiffPicNumMinus1
183+ // abs_diff_pic_num_minus1 should be in range 0 to MaxPicNum-1, MaxPicNum is derived as
184+ // 2^(4+log2_max_frame_num_minus4)
185+ uint32_t uiTmp = BsGetUe (pBs);
186+ WELS_CHECK_SE_UPPER_ERROR_NOLOG (uiTmp, (1 << pSps->uiLog2MaxFrameNum), "abs_diff_pic_num_minus1",
187+ GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_INVALID_REF_REORDERING));
188+ pRefPicListReordering->sReorderingSyn[iList][iIdx].uiAbsDiffPicNumMinus1 = uiTmp; // uiAbsDiffPicNumMinus1
184189 } else if (kuiIdc == 2) {
185190 pRefPicListReordering->sReorderingSyn[iList][iIdx].uiLongTermPicNum = BsGetUe (pBs);
186191 }
@@ -199,7 +204,7 @@ int32_t ParseRefPicListReordering (PBitStringAux pBs, PSliceHeader pSh) { · 12 unmodified lines
199204 int32_t ParseDecRefPicMarking (PWelsDecoderContext pCtx, PBitStringAux pBs, PSliceHeader pSh, PSps pSps,
200205 const bool kbIdrFlag) {
201206 PRefPicMarking const kpRefMarking = &pSh->sRefMarking;
202−
207+ PRefPic pRefPic = &pCtx->sRefPic;
203208 if (kbIdrFlag) {
204209 kpRefMarking->bNoOutputOfPriorPicsFlag = !!BsGetOneBit (pBs);
205210 kpRefMarking->bLongTermRefFlag = !!BsGetOneBit (pBs);
@@ -447,6 +452,13 @@ int32_t CheckSpsId (PWelsDecoderContext pCtx, PSubsetSps* ppSubsetSps, PSps* ppS · 241 unmodified lines
447452 }
448453
449454 #endif
455+
456+#define SLICE_HEADER_IDR_PIC_ID_MAX 65535
457+#define SLICE_HEADER_REDUNDANT_PIC_CNT_MAX 127
458+#define SLICE_HEADER_ALPHAC0_BETA_OFFSET_MIN -12
459+#define SLICE_HEADER_ALPHAC0_BETA_OFFSET_MAX 12
460+#define SLICE_HEADER_INTER_LAYER_ALPHAC0_BETA_OFFSET_MIN -12
461+#define SLICE_HEADER_INTER_LAYER_ALPHAC0_BETA_OFFSET_MAX 12
450462 /*
451463 * decode_slice_header_avc
452464 * Parse slice header of bitstream in avc for storing data structure
@@ -465,6 +477,7 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co · 12 unmodified lines
465477 int32_t iRet = ERR_NONE;
466478 uint8_t uiSliceType = 0;
467479 uint8_t uiQualityId = BASE_QUALITY_ID;
480+ uint32_t uiTmp;
468481 bool bIdrFlag = false;
469482 bool bSgChangeCycleInvolved = false; // involved slice group change cycle ?
470483
@@ -489,6 +502,7 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co · 18 unmodified lines
489502
490503 kpCurNal->sNalData.sVclNal.bSliceHeaderExtFlag = kbExtensionFlag;
491504
505+ // first_mb_in_slice
492506 pSliceHead->iFirstMbInSlice = BsGetUe (pBs);
493507
494508 uiSliceType = BsGetUe (pBs);
@@ -500,7 +514,7 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co · 5 unmodified lines
500514 if (uiSliceType > 4)
501515 uiSliceType -= 5;
502516
503− if((eNalType == NAL_UNIT_CODED_SLICE_IDR) && (uiSliceType != 2)){
517+ if ((eNalType == NAL_UNIT_CODED_SLICE_IDR) && (uiSliceType != 2)) {
504518 WelsLog (pCtx, WELS_LOG_WARNING, "Invalid slice type(%d) in IDR picture. \n", uiSliceType);
505519 return GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_INVALID_SLICE_TYPE);
506520 }
@@ -566,6 +580,9 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co · 59 unmodified lines
566580 WelsLog (pCtx, WELS_LOG_WARNING, "non existing SPS referenced\n");
567581 return GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_NO_PARAM_SETS);
568582 }
583+ // check first_mb_in_slice
584+ WELS_CHECK_SE_UPPER_ERROR ((uint32_t) (pSliceHead->iFirstMbInSlice), pSps->uiTotalMbCount, "first_mb_in_slice",
585+ GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_INVALID_FIRST_MB_IN_SLICE));
569586 pSliceHead->iFrameNum = BsGetBits (pBs, pSps->uiLog2MaxFrameNum);
570587
571588 pSliceHead->bFieldPicFlag = false;
@@ -584,7 +601,11 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co · 12 unmodified lines
584601 pSliceHead->iFrameNum);
585602 return GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_INVALID_FRAME_NUM);
586603 }
587− pSliceHead->uiIdrPicId = BsGetUe (pBs); /* uiIdrPicId */
604+ uiTmp = BsGetUe (pBs);
605+ // standard 7.4.3 idr_pic_id should be in range 0 to 65535, inclusive.
606+ WELS_CHECK_SE_UPPER_ERROR (uiTmp, SLICE_HEADER_IDR_PIC_ID_MAX, "idr_pic_id", GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER,
607+ ERR_INFO_INVALID_IDR_PIC_ID));
608+ pSliceHead->uiIdrPicId = uiTmp; /* uiIdrPicId */
588609 #ifdef LONG_TERM_REF
589610 pCtx->uiCurIdrPicId = pSliceHead->uiIdrPicId;
590611 #endif
@@ -606,7 +627,11 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co · 15 unmodified lines
606627
607628 pSliceHead->iRedundantPicCnt = 0;
608629 if (pPps->bRedundantPicCntPresentFlag) {
609− pSliceHead->iRedundantPicCnt = BsGetUe (pBs);
630+ uiTmp = BsGetUe (pBs);
631+ // standard section 7.4.3, redundant_pic_cnt should be in range 0 to 127, inclusive.
632+ WELS_CHECK_SE_UPPER_ERROR (uiTmp, SLICE_HEADER_REDUNDANT_PIC_CNT_MAX, "redundant_pic_cnt",
633+ GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_INVALID_REDUNDANT_PIC_CNT));
634+ pSliceHead->iRedundantPicCnt = uiTmp;
610635 }
611636
612637 //set defaults, might be overriden a few line later
@@ -695,7 +720,13 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co · 82 unmodified lines
695720 }
696721 if (pSliceHead->uiDisableDeblockingFilterIdc != 1) {
697722 pSliceHead->iSliceAlphaC0Offset = BsGetSe (pBs) * 2; // slice_alpha_c0_offset_div2
723+ WELS_CHECK_SE_BOTH_ERROR (pSliceHead->iSliceAlphaC0Offset, SLICE_HEADER_ALPHAC0_BETA_OFFSET_MIN,
724+ SLICE_HEADER_ALPHAC0_BETA_OFFSET_MAX, "slice_alpha_c0_offset_div2 * 2", GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER,
725+ ERR_INFO_INVALID_SLICE_ALPHA_C0_OFFSET_DIV2));
698726 pSliceHead->iSliceBetaOffset = BsGetSe (pBs) * 2; // iSliceBetaOffset
727+ WELS_CHECK_SE_BOTH_ERROR (pSliceHead->iSliceBetaOffset, SLICE_HEADER_ALPHAC0_BETA_OFFSET_MIN,
728+ SLICE_HEADER_ALPHAC0_BETA_OFFSET_MAX, "slice_beta_offset_div2 * 2", GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER,
729+ ERR_INFO_INVALID_SLICE_BETA_OFFSET_DIV2));
699730 }
700731 }
701732
@@ -731,7 +762,14 @@ int32_t ParseSliceHeaderSyntaxs (PWelsDecoderContext pCtx, PBitStringAux pBs, co · 29 unmodified lines
731762 }
732763 if (pSliceHeadExt->uiDisableInterLayerDeblockingFilterIdc != 1) {
733764 pSliceHeadExt->iInterLayerSliceAlphaC0Offset = BsGetSe (pBs) << 1;
765+ WELS_CHECK_SE_BOTH_ERROR (pSliceHeadExt->iInterLayerSliceAlphaC0Offset,
766+ SLICE_HEADER_INTER_LAYER_ALPHAC0_BETA_OFFSET_MIN, SLICE_HEADER_INTER_LAYER_ALPHAC0_BETA_OFFSET_MAX,
767+ "inter_layer_alpha_c0_offset_div2 * 2", GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER,
768+ ERR_INFO_INVALID_SLICE_ALPHA_C0_OFFSET_DIV2));
734769 pSliceHeadExt->iInterLayerSliceBetaOffset = BsGetSe (pBs) << 1;
770+ WELS_CHECK_SE_BOTH_ERROR (pSliceHeadExt->iInterLayerSliceBetaOffset, SLICE_HEADER_INTER_LAYER_ALPHAC0_BETA_OFFSET_MIN,
771+ SLICE_HEADER_INTER_LAYER_ALPHAC0_BETA_OFFSET_MAX, "inter_layer_slice_beta_offset_div2 * 2",
772+ GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_INVALID_SLICE_BETA_OFFSET_DIV2));
735773 }
736774 }
737775

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t