History

add safety check for bit-reading for headers

Licai Guo committed 12 years ago

Commit a3c38b51 parent e79769f7 files · +676 −488Browse files

Showing the changes to codec/decoder/core/src/decode_slice.cpp (1 of 7 files). Show all

Unified · Split

codec/decoder/core/src/decode_slice.cpp+27−11
@@ -271,7 +271,7 @@ int32_t WelsMbInterPrediction (PWelsDecoderContext pCtx, PDqLayer pCurLayer) { · 270 unmodified lines
271271 }
272272
273273 void WelsMbCopy (uint8_t* pDst, int32_t iStrideDst, uint8_t* pSrc, int32_t iStrideSrc,
274− int32_t iHeight, int32_t iWidth) {
274+ int32_t iHeight, int32_t iWidth) {
275275 int32_t i;
276276 int32_t iOffsetDst = 0, iOffsetSrc = 0;
277277 for (i = 0; i < iHeight; i++) {
@@ -491,13 +491,16 @@ int32_t WelsActualDecodeMbCavlcISlice (PWelsDecoderContext pCtx) { · 213 unmodified lines
491491 int32_t iMbXy = pCurLayer->iMbXyIndex;
492492 int32_t iNMbMode, i;
493493 uint32_t uiMbType = 0, uiCbp = 0, uiCbpL = 0, uiCbpC = 0;
494+ uint32_t uiCode;
495+ int32_t iCode;
494496
495497 ENFORCE_STACK_ALIGN_1D (uint8_t, pNonZeroCount, 48, 16);
496498
497499 pCurLayer->pInterPredictionDoneFlag[iMbXy] = 0;
498500 pCurLayer->pResidualPredFlag[iMbXy] = pSlice->sSliceHeaderExt.bDefaultResidualPredFlag;
499501
500− uiMbType = BsGetUe (pBs);
502+ WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //mb_type
503+ uiMbType = uiCode;
501504 if (uiMbType > 25) {
502505 return ERR_INFO_INVALID_MB_TYPE;
503506 }
@@ -561,7 +564,8 @@ int32_t WelsActualDecodeMbCavlcISlice (PWelsDecoderContext pCtx) { · 57 unmodified lines
561564 }
562565
563566 //uiCbp
564− uiCbp = BsGetUe (pBs);
567+ WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //coded_block_pattern
568+ uiCbp = uiCode;
565569 //G.9.1 Alternative parsing process for coded pBlock pattern
566570 if (uiCbp > 47)
567571 return ERR_INFO_INVALID_CBP;
@@ -603,7 +607,8 @@ int32_t WelsActualDecodeMbCavlcISlice (PWelsDecoderContext pCtx) { · 35 unmodified lines
603607 if (pCurLayer->pCbp[iMbXy] || MB_TYPE_INTRA16x16 == pCurLayer->pMbType[iMbXy]) {
604608 int32_t iQpDelta, iId8x8, iId4x4;
605609
606− iQpDelta = BsGetSe (pBs);
610+ WELS_READ_VERIFY (BsGetSe (pBs, &iCode)); //mb_qp_delta
611+ iQpDelta = iCode;
607612
608613 if (iQpDelta > 25 || iQpDelta < -26) { //out of iQpDelta range
609614 return ERR_INFO_INVALID_QP;
@@ -732,9 +737,11 @@ int32_t WelsDecodeMbCavlcISlice (PWelsDecoderContext pCtx, PNalUnit pNalCur) { · 122 unmodified lines
732737 PSliceHeaderExt pSliceHeaderExt = &pCurLayer->sLayerInfo.sSliceInLayer.sSliceHeaderExt;
733738 int32_t iBaseModeFlag;
734739 int32_t iRet = 0; //should have the return value to indicate decoding error or not, It's NECESSARY--2010.4.15
740+ uint32_t uiCode;
735741
736742 if (pSliceHeaderExt->bAdaptiveBaseModeFlag == 1) {
737− iBaseModeFlag = BsGetOneBit (pBs);
743+ WELS_READ_VERIFY (BsGetOneBit (pBs, &uiCode)); //base_mode_flag
744+ iBaseModeFlag = uiCode;
738745 } else {
739746 iBaseModeFlag = pSliceHeaderExt->bDefaultBaseModeFlag;
740747 }
@@ -769,11 +776,14 @@ int32_t WelsActualDecodeMbCavlcPSlice (PWelsDecoderContext pCtx) { · 28 unmodified lines
769776
770777 int32_t iNMbMode, i;
771778 uint32_t uiMbType = 0, uiCbp = 0, uiCbpL = 0, uiCbpC = 0;
779+ uint32_t uiCode;
780+ int32_t iCode;
772781
773782 ENFORCE_STACK_ALIGN_1D (uint8_t, pNonZeroCount, 48, 16);
774783 pCurLayer->pInterPredictionDoneFlag[iMbXy] = 0;//2009.10.23
775784
776− uiMbType = BsGetUe (pBs);
785+ WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //mb_type
786+ uiMbType = uiCode;
777787 if (uiMbType < 5) { //inter MB type
778788 int16_t iMotionVector[LIST_A][30][MV_A];
779789
@@ -785,7 +795,8 @@ int32_t WelsActualDecodeMbCavlcPSlice (PWelsDecoderContext pCtx) { · 5 unmodified lines
785795 }
786796
787797 if (pSlice->sSliceHeaderExt.bAdaptiveResidualPredFlag == 1) {
788− pCurLayer->pResidualPredFlag[iMbXy] = BsGetOneBit (pBs);
798+ WELS_READ_VERIFY (BsGetOneBit (pBs, &uiCode)); //residual_prediction_flag
799+ pCurLayer->pResidualPredFlag[iMbXy] = uiCode;
789800 } else {
790801 pCurLayer->pResidualPredFlag[iMbXy] = pSlice->sSliceHeaderExt.bDefaultResidualPredFlag;
791802 }
@@ -882,7 +893,8 @@ int32_t WelsActualDecodeMbCavlcPSlice (PWelsDecoderContext pCtx) { · 90 unmodified lines
882893 }
883894
884895 if (MB_TYPE_INTRA16x16 != pCurLayer->pMbType[iMbXy]) {
885− uiCbp = BsGetUe (pBs);
896+ WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //coded_block_pattern
897+ uiCbp = uiCode;
886898 {
887899 if (uiCbp > 47)
888900 return ERR_INFO_INVALID_CBP;
@@ -918,7 +930,8 @@ int32_t WelsActualDecodeMbCavlcPSlice (PWelsDecoderContext pCtx) { · 29 unmodified lines
918930 if (pCurLayer->pCbp[iMbXy] || MB_TYPE_INTRA16x16 == pCurLayer->pMbType[iMbXy]) {
919931 int32_t iQpDelta, iId8x8, iId4x4;
920932
921− iQpDelta = BsGetSe (pBs);
933+ WELS_READ_VERIFY (BsGetSe (pBs, &iCode)); //mb_qp_delta
934+ iQpDelta = iCode;
922935
923936 if (iQpDelta > 25 || iQpDelta < -26) { //out of iQpDelta range
924937 return ERR_INFO_INVALID_QP;
@@ -1048,9 +1061,11 @@ int32_t WelsDecodeMbCavlcPSlice (PWelsDecoderContext pCtx, PNalUnit pNalCur) { · 123 unmodified lines
10481061 int32_t iMbXy = pCurLayer->iMbXyIndex;
10491062 int32_t iBaseModeFlag, i;
10501063 int32_t iRet = 0; //should have the return value to indicate decoding error or not, It's NECESSARY--2010.4.15
1064+ uint32_t uiCode;
10511065
10521066 if (-1 == pSlice->iMbSkipRun) {
1053− pSlice->iMbSkipRun = BsGetUe (pBs);
1067+ WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //mb_skip_run
1068+ pSlice->iMbSkipRun = uiCode;
10541069 if (-1 == pSlice->iMbSkipRun) {
10551070 return -1;
10561071 }
@@ -1094,7 +1109,8 @@ int32_t WelsDecodeMbCavlcPSlice (PWelsDecoderContext pCtx, PNalUnit pNalCur) { · 37 unmodified lines
10941109 }
10951110
10961111 if (pSlice->sSliceHeaderExt.bAdaptiveBaseModeFlag == 1) {
1097− iBaseModeFlag = BsGetOneBit (pBs);
1112+ WELS_READ_VERIFY (BsGetOneBit (pBs, &uiCode)); //base_mode_flag
1113+ iBaseModeFlag = uiCode;
10981114 } else {
10991115 iBaseModeFlag = pSlice->sSliceHeaderExt.bDefaultBaseModeFlag;
11001116 }

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t