shithub: openh264

Download patch

ref: fee0f14732c88c7a11bbb4d40becfd37717b9208
parent: 4e0b8d4cbfaa39ce2474c70cd9a801e5c0da1b90
author: Licai Guo <guolicai@gmail.com>
date: Thu Feb 20 19:16:42 EST 2014

finish syntax checks in ParseSps

--- a/codec/decoder/core/inc/dec_golomb.h
+++ b/codec/decoder/core/inc/dec_golomb.h
@@ -319,6 +319,8 @@
 #define NUM_REF_IDX_L0_ACTIVE_OFFSET 1
 #define NUM_REF_IDX_L1_ACTIVE_OFFSET 1
 
+// From Level 5.2
+#define MAX_MB_SIZE 36864
 } // namespace WelsDec
 
 #endif//WELS_EXPONENTIAL_GOLOMB_ENTROPY_CODING_H__
--- a/codec/decoder/core/inc/error_code.h
+++ b/codec/decoder/core/inc/error_code.h
@@ -110,6 +110,7 @@
   ERR_INFO_INVALID_IDR_PIC_ID,
   ERR_INFO_INVALID_REDUNDANT_PIC_CNT,
   ERR_INFO_INVALID_MAX_NUM_REF_FRAMES,
+  ERR_INFO_INVALID_MAX_MB_SIZE,
   ERR_INFO_INVALID_FIRST_MB_IN_SLICE,
   ERR_INFO_INVALID_NUM_REF_IDX_L0_ACTIVE_MINUS1,
   ERR_INFO_INVALID_SLICE_ALPHA_C0_OFFSET_DIV2,
--- a/codec/decoder/core/src/au_parser.cpp
+++ b/codec/decoder/core/src/au_parser.cpp
@@ -871,8 +871,6 @@
   } else pSps->pSLevelLimits = pSLevelLimits;
   // syntax elements in default
   pSps->uiChromaFormatIdc	= 1;
-  pSps->uiBitDepthLuma		=
-    pSps->uiBitDepthChroma	= 8;
 
   pSps->uiProfileIdc	= uiProfileIdc;
   pSps->uiLevelIdc	= uiLevelIdc;
@@ -895,7 +893,7 @@
       WelsLog (pCtx, WELS_LOG_WARNING, "ParseSps(): bit_depth_luma (%d) Only 8 bit supported.\n", 8 + uiCode);
       return GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_UNSUPPORTED_NON_BASELINE);
     }
-    pSps->uiBitDepthLuma		= 8 + uiCode;
+    pSps->uiBitDepthLuma		= 8;
 
     WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //bit_depth_chroma_minus8
     if (uiCode != 0) {
@@ -902,7 +900,7 @@
       WelsLog (pCtx, WELS_LOG_WARNING, "ParseSps(): bit_depth_chroma (%d). Only 8 bit supported.\n", 8 + uiCode);
       return GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_UNSUPPORTED_NON_BASELINE);
     }
-    pSps->uiBitDepthChroma	= 8 + uiCode;
+    pSps->uiBitDepthChroma	= 8;
 
     WELS_READ_VERIFY (BsGetOneBit (pBs, &uiCode)); //qpprime_y_zero_transform_bypass_flag
     pSps->bQpPrimeYZeroTransfBypassFlag	= !!uiCode;
@@ -958,18 +956,27 @@
   pSps->bGapsInFrameNumValueAllowedFlag	= !!uiCode;
   WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //pic_width_in_mbs_minus1
   pSps->iMbWidth		= PIC_WIDTH_IN_MBS_OFFSET + uiCode;
-  if ((uint64_t) (pSps->iMbWidth * pSps->iMbWidth) > (8 * pSLevelLimits->iMaxFS)) {
+  if (pSps->iMbWidth > MAX_MB_SIZE) {
+    WelsLog (pCtx, WELS_LOG_ERROR, "pic_width_in_mbs(%d) exceeds the maximum allowed!\n", pSps->iMbWidth);
+    return  GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_INVALID_MAX_MB_SIZE);
+  }
+  if (((uint64_t)pSps->iMbWidth * (uint64_t)pSps->iMbWidth) > (8 * pSLevelLimits->iMaxFS)) {
     WelsLog (pCtx, WELS_LOG_WARNING, " the pic_width_in_mbs exceeds the level limits!\n");
   }
   WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //pic_height_in_map_units_minus1
   pSps->iMbHeight		= PIC_HEIGHT_IN_MAP_UNITS_OFFSET + uiCode;
-  if ((uint64_t) (pSps->iMbHeight * pSps->iMbHeight) > (8 * pSLevelLimits->iMaxFS)) {
+  if (pSps->iMbHeight > MAX_MB_SIZE) {
+    WelsLog (pCtx, WELS_LOG_ERROR, "pic_height_in_mbs(%d) exceeds the maximum allowed!\n", pSps->iMbHeight);
+    return  GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_INVALID_MAX_MB_SIZE);
+  }
+  if (((uint64_t)pSps->iMbHeight * (uint64_t)pSps->iMbHeight) > (8 * pSLevelLimits->iMaxFS)) {
     WelsLog (pCtx, WELS_LOG_WARNING, " the pic_height_in_mbs exceeds the level limits!\n");
   }
-  pSps->uiTotalMbCount	= pSps->iMbWidth * pSps->iMbHeight;
-  if (pSps->uiTotalMbCount > (uint32_t)pSLevelLimits->iMaxFS) {
+  uint64_t uiTmp64 = (uint64_t)pSps->iMbWidth * (uint64_t)pSps->iMbHeight;
+  if (uiTmp64 > (uint32_t)pSLevelLimits->iMaxFS) {
     WelsLog (pCtx, WELS_LOG_WARNING, " the total count of mb exceeds the level limits!\n");
   }
+  pSps->uiTotalMbCount	= uiTmp64;
   WELS_CHECK_SE_UPPER_ERROR (pSps->iNumRefFrames, SPS_MAX_NUM_REF_FRAMES_MAX, "max_num_ref_frames",
                              GENERATE_ERROR_NO (ERR_LEVEL_PARAM_SETS, ERR_INFO_INVALID_MAX_NUM_REF_FRAMES));
   // here we check max_num_ref_frames