From patchwork Sun May 19 22:41:38 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yan Cen X-Patchwork-Id: 13199 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id C0CB54491A6 for ; Mon, 20 May 2019 02:05:27 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 97F1668A450; Mon, 20 May 2019 02:05:27 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-pl1-f195.google.com (mail-pl1-f195.google.com [209.85.214.195]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id BCDC168A2FA for ; Mon, 20 May 2019 02:05:20 +0300 (EEST) Received: by mail-pl1-f195.google.com with SMTP id a5so5776116pls.12 for ; Sun, 19 May 2019 16:05:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=iCV5Po/1IOEOCJ9drwPOEt4jicdbfT/A9MaBoyinAfw=; b=CqZ9rzTY9hEn4uA+Y0/nTP6re2XQogvx1gCUiu4Kp4X9hC/DLjQ9VOaRXJF4hapym6 gfzeyZWgVm6EwpqbyXra008HT0JW/TyfduNYmUEXs9KFbVU/uFcIcJmstvNy7aHJA0mT /NgpbrrKjgAame6Mdis465ulXZ9e5erMRzDo0NHi0ZYSdk974ufSB/S9v3ZUrcrPukB7 HrTx6hUVIhPZ2h4s9FFWW8fuRf7KFlI5U1poYmhAFXz2Dl78ufhvQEDEvy+m1LdF85kr dawMtcnMIvyERSGYmiVJrekkAVxfdU7WrJavcLNikjg9zShAUIu6L3A/d5Udjf7+ktTd phuA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=iCV5Po/1IOEOCJ9drwPOEt4jicdbfT/A9MaBoyinAfw=; b=oaYTIWuBTTHzSgc+ICZX4gJ+43xfAhI3WiMbz2U64JEN3NLcI26zh7v81HW5DZ83f4 4jybs7npAtoQEPdqRzDJlGjqbUfvwNP5i7lkp63m+svC2jIR4VaAziXnWNdAZ7SSjn3G F3bsr5SEe60wiuqJ24NIEsbFAIc6FC3++8SKGKIrwwDDwJ28LaX+19qrW57usKOfoB+Y 6vuaSmEVrfjF2h0iBqoZd2ZSlgfh/N+OoqDoXHXo1RvHXBUMLpC6u4m7wk+VT6TOQK0q 4B+L92Az6ic2ZtOiejlsNnaKv5l6lP8hl4vDOpie4YxbQlK+CKnxntqgOXtK8E59qdWC Qu3g== X-Gm-Message-State: APjAAAWX7FR9Brujuu06A/inkxPONGwd/jrTOQoO9GbFFUvKiaoVICOr oH9bTGGtovEDjoRItEqOnWLk8jwx X-Google-Smtp-Source: APXvYqzq+UNcTpiqwuIvXYBZ6ymEMJLRvrXbSlX2PpON7t2mJvLOvrb389mb326mrUkJDAjdVGnTlg== X-Received: by 2002:a17:902:9f83:: with SMTP id g3mr56534400plq.330.1558306776781; Sun, 19 May 2019 15:59:36 -0700 (PDT) Received: from localhost.localdomain ([198.148.118.159]) by smtp.gmail.com with ESMTPSA id w4sm17667349pfi.87.2019.05.19.15.59.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 19 May 2019 15:59:36 -0700 (PDT) From: Yan Cen To: ffmpeg-devel@ffmpeg.org Date: Mon, 20 May 2019 06:41:38 +0800 Message-Id: <1558305698-18774-1-git-send-email-mryancen@gmail.com> X-Mailer: git-send-email 2.7.4 Subject: [FFmpeg-devel] [PATCH v2] libavcodec/vp9: fix ref-frame size judging method X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Xiang Haihao , Li Zhong , yancen MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" From: yancen There is no need all reference frame demension is valid in libvpx. So this change contains three part: 1. Change each judgement's loglevel from "ERROR" to "WARNING" 2. Make sure at least one of frames that this frame references has valid dimension. 3. All judgements fail would report "ERROR". Signed-off-by: Xiang Haihao Signed-off-by: Li Zhong Signed-off-by: Yan Cen --- libavcodec/vp9.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/libavcodec/vp9.c b/libavcodec/vp9.c index acf3ffc..849c1a6 100644 --- a/libavcodec/vp9.c +++ b/libavcodec/vp9.c @@ -790,6 +790,7 @@ static int decode_frame_header(AVCodecContext *avctx, /* check reference frames */ if (!s->s.h.keyframe && !s->s.h.intraonly) { + int has_valid_ref_frame = 0; for (i = 0; i < 3; i++) { AVFrame *ref = s->s.refs[s->s.h.refidx[i]].f; int refw = ref->width, refh = ref->height; @@ -802,12 +803,15 @@ static int decode_frame_header(AVCodecContext *avctx, return AVERROR_INVALIDDATA; } else if (refw == w && refh == h) { s->mvscale[i][0] = s->mvscale[i][1] = 0; + has_valid_ref_frame = 1; } else { - if (w * 2 < refw || h * 2 < refh || w > 16 * refw || h > 16 * refh) { - av_log(avctx, AV_LOG_ERROR, + int is_ref_frame_invalid = (w * 2 < refw || h * 2 < refh || w > 16 * refw || h > 16 * refh); + if (is_ref_frame_invalid) { + av_log(avctx, AV_LOG_WARNING, "Invalid ref frame dimensions %dx%d for frame size %dx%d\n", refw, refh, w, h); - return AVERROR_INVALIDDATA; + } else { + has_valid_ref_frame = 1; } s->mvscale[i][0] = (refw << 14) / w; s->mvscale[i][1] = (refh << 14) / h; @@ -815,6 +819,11 @@ static int decode_frame_header(AVCodecContext *avctx, s->mvstep[i][1] = 16 * s->mvscale[i][1] >> 14; } } + if (!has_valid_ref_frame) { + av_log(avctx, AV_LOG_ERROR, + "Referenced frame has invalid size\n"); + return AVERROR_INVALIDDATA; + } } if (s->s.h.keyframe || s->s.h.errorres || (s->s.h.intraonly && s->s.h.resetctx == 3)) {