shithub: openh264

Download patch

ref: abc2495f2ff9c077316285bddeced48c2a95c3d4
parent: bf0179310c3a20e613de69b2c0573fb2253f5555
parent: 265741e92294538a1e3d1500bb17abd18e827722
author: huili2 <huili2@cisco.com>
date: Mon Feb 24 05:35:10 EST 2014 

Merge pull request #335 from licaiguo/decoder-syntax-checks

Decoder syntax checks


--- a/codec/decoder/core/inc/dec_golomb.h
+++ b/codec/decoder/core/inc/dec_golomb.h
@@ -319,6 +319,8 @@
 #define NUM_REF_IDX_L0_ACTIVE_OFFSET 1
 #define NUM_REF_IDX_L1_ACTIVE_OFFSET 1
 
+// From Level 5.2
+#define MAX_MB_SIZE 36864
 } // namespace WelsDec
 
 #endif//WELS_EXPONENTIAL_GOLOMB_ENTROPY_CODING_H__
--- a/codec/decoder/core/inc/error_code.h
+++ b/codec/decoder/core/inc/error_code.h
@@ -110,6 +110,7 @@
   ERR_INFO_INVALID_IDR_PIC_ID,
   ERR_INFO_INVALID_REDUNDANT_PIC_CNT,
   ERR_INFO_INVALID_MAX_NUM_REF_FRAMES,
+  ERR_INFO_INVALID_MAX_MB_SIZE,
   ERR_INFO_INVALID_FIRST_MB_IN_SLICE,
   ERR_INFO_INVALID_NUM_REF_IDX_L0_ACTIVE_MINUS1,
   ERR_INFO_INVALID_SLICE_ALPHA_C0_OFFSET_DIV2,
--- a/codec/decoder/core/src/au_parser.cpp
+++ b/codec/decoder/core/src/au_parser.cpp
@@ -833,11 +833,11 @@
   WELS_READ_VERIFY (BsGetBits (pBs, 8, &uiCode)); // level_idc
   uiLevelIdc	= uiCode;
   WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //seq_parameter_set_id
-  iSpsId		= uiCode;
-  if (iSpsId >= MAX_SPS_COUNT || iSpsId < 0) {	// Modified to check invalid negative iSpsId, 12/1/2009
+  if (uiCode >= MAX_SPS_COUNT) {	// Modified to check invalid negative iSpsId, 12/1/2009
     WelsLog (pCtx, WELS_LOG_WARNING, " iSpsId is out of range! \n");
     return GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_SPS_ID_OVERFLOW);
   }
+  iSpsId		= uiCode;
 
   if (kbUseSubsetFlag) {
 #ifdef MOSAIC_AVOID_BASED_ON_SPS_PPS_ID
@@ -871,8 +871,6 @@
   } else pSps->pSLevelLimits = pSLevelLimits;
   // syntax elements in default
   pSps->uiChromaFormatIdc	= 1;
-  pSps->uiBitDepthLuma		=
-    pSps->uiBitDepthChroma	= 8;
 
   pSps->uiProfileIdc	= uiProfileIdc;
   pSps->uiLevelIdc	= uiLevelIdc;
@@ -891,18 +889,19 @@
     }
     pSps->uiChromaArrayType = pSps->uiChromaFormatIdc;
     WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //bit_depth_luma_minus8
-    pSps->uiBitDepthLuma		= 8 + uiCode;
-    if (pSps->uiBitDepthLuma != 8) {
-      WelsLog (pCtx, WELS_LOG_WARNING, "ParseSps(): bit_depth_luma (%d) Only 8 bit supported.\n", pSps->uiBitDepthLuma);
+    if (uiCode != 0) {
+      WelsLog (pCtx, WELS_LOG_WARNING, "ParseSps(): bit_depth_luma (%d) Only 8 bit supported.\n", 8 + uiCode);
       return GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_UNSUPPORTED_NON_BASELINE);
     }
+    pSps->uiBitDepthLuma		= 8;
 
     WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //bit_depth_chroma_minus8
-    pSps->uiBitDepthChroma	= 8 + uiCode;
-    if (pSps->uiBitDepthChroma != 8) {
-      WelsLog (pCtx, WELS_LOG_WARNING, "ParseSps(): bit_depth_chroma (%d). Only 8 bit supported.\n", pSps->uiBitDepthChroma);
+    if (uiCode != 0) {
+      WelsLog (pCtx, WELS_LOG_WARNING, "ParseSps(): bit_depth_chroma (%d). Only 8 bit supported.\n", 8 + uiCode);
       return GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_UNSUPPORTED_NON_BASELINE);
     }
+    pSps->uiBitDepthChroma	= 8;
+
     WELS_READ_VERIFY (BsGetOneBit (pBs, &uiCode)); //qpprime_y_zero_transform_bypass_flag
     pSps->bQpPrimeYZeroTransfBypassFlag	= !!uiCode;
     WELS_READ_VERIFY (BsGetOneBit (pBs, &uiCode)); //seq_scaling_matrix_present_flag
@@ -956,27 +955,28 @@
   WELS_READ_VERIFY (BsGetOneBit (pBs, &uiCode)); //gaps_in_frame_num_value_allowed_flag
   pSps->bGapsInFrameNumValueAllowedFlag	= !!uiCode;
   WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //pic_width_in_mbs_minus1
-  if (uiCode == 0xffffffff) {
-    WelsLog (pCtx, WELS_LOG_ERROR, " pic_width_in_mbs read error!\n");
-    return GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_INVALID_MB_SIZE_INFO);
-  }
   pSps->iMbWidth		= PIC_WIDTH_IN_MBS_OFFSET + uiCode;
-  if ((uint64_t) (pSps->iMbWidth * pSps->iMbWidth) > (8 * pSLevelLimits->iMaxFS)) {
+  if (pSps->iMbWidth > MAX_MB_SIZE) {
+    WelsLog (pCtx, WELS_LOG_ERROR, "pic_width_in_mbs(%d) exceeds the maximum allowed!\n", pSps->iMbWidth);
+    return  GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_INVALID_MAX_MB_SIZE);
+  }
+  if (((uint64_t)pSps->iMbWidth * (uint64_t)pSps->iMbWidth) > (8 * pSLevelLimits->iMaxFS)) {
     WelsLog (pCtx, WELS_LOG_WARNING, " the pic_width_in_mbs exceeds the level limits!\n");
   }
   WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //pic_height_in_map_units_minus1
-  if (uiCode == 0xffffffff) {
-    WelsLog (pCtx, WELS_LOG_ERROR, " pic_height_in_mbs read error!\n");
-    return GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_INVALID_MB_SIZE_INFO);
-  }
   pSps->iMbHeight		= PIC_HEIGHT_IN_MAP_UNITS_OFFSET + uiCode;
-  if ((uint64_t) (pSps->iMbHeight * pSps->iMbHeight) > (8 * pSLevelLimits->iMaxFS)) {
+  if (pSps->iMbHeight > MAX_MB_SIZE) {
+    WelsLog (pCtx, WELS_LOG_ERROR, "pic_height_in_mbs(%d) exceeds the maximum allowed!\n", pSps->iMbHeight);
+    return  GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_INVALID_MAX_MB_SIZE);
+  }
+  if (((uint64_t)pSps->iMbHeight * (uint64_t)pSps->iMbHeight) > (8 * pSLevelLimits->iMaxFS)) {
     WelsLog (pCtx, WELS_LOG_WARNING, " the pic_height_in_mbs exceeds the level limits!\n");
   }
-  pSps->uiTotalMbCount	= pSps->iMbWidth * pSps->iMbHeight;
-  if (pSps->uiTotalMbCount > (uint32_t)pSLevelLimits->iMaxFS) {
+  uint32_t uiTmp32 = pSps->iMbWidth * pSps->iMbHeight;
+  if (uiTmp32 > (uint32_t)pSLevelLimits->iMaxFS) {
     WelsLog (pCtx, WELS_LOG_WARNING, " the total count of mb exceeds the level limits!\n");
   }
+  pSps->uiTotalMbCount	= uiTmp32;
   WELS_CHECK_SE_UPPER_ERROR (pSps->iNumRefFrames, SPS_MAX_NUM_REF_FRAMES_MAX, "max_num_ref_frames",
                              GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_INVALID_MAX_NUM_REF_FRAMES));
   // here we check max_num_ref_frames