@@ -33,22 +33,22 @@ extern const uint8_t ff_vp8_token_update_probs[4][8][3][11];
typedef struct CBSVP8BoolDecoder {
GetBitContext *gbc;
- uint8_t value;
uint8_t range;
- uint8_t count; // Store the number of bits in the `value` buffer.
-
+ uint8_t value;
+ // Store the number of bits in the `value` buffer.
+ uint8_t count;
} CBSVP8BoolDecoder;
-static int cbs_vp8_bool_decoder_init(CBSVP8BoolDecoder *decoder, GetBitContext *gbc)
+static int cbs_vp8_bool_decoder_init(CBSVP8BoolDecoder *decoder,
+ GetBitContext *gbc)
{
av_assert0(decoder);
av_assert0(gbc);
decoder->gbc = gbc;
- decoder->value = 0;
decoder->range = 255;
-
+ decoder->value = 0;
decoder->count = 0;
return 0;
@@ -60,7 +60,7 @@ static bool cbs_vp8_bool_decoder_fill_value(CBSVP8BoolDecoder *decoder)
av_assert0(decoder->count <= 8);
if (decoder->count == 8) {
- return true;
+ return true;
}
if (get_bits_left(decoder->gbc) >= bits) {
@@ -141,7 +141,7 @@ static int cbs_vp8_bool_decoder_read_unsigned(
}
if (trace_enable) {
- CBS_TRACE_READ_END();
+ CBS_TRACE_READ_END();
}
*write_to = value;
@@ -181,9 +181,11 @@ static int cbs_vp8_bool_decoder_read_signed(
return 0;
}
-static int cbs_vp8_read_unsigned_le(CodedBitstreamContext *ctx, GetBitContext *gbc,
- int width, const char *name,
- const int *subscripts, uint32_t *write_to)
+static int cbs_vp8_read_unsigned_le(CodedBitstreamContext *ctx,
+ GetBitContext *gbc, int width,
+ const char *name, const int *subscripts,
+ uint32_t *write_to, uint32_t range_min,
+ uint32_t range_max)
{
int32_t value;
@@ -200,6 +202,14 @@ static int cbs_vp8_read_unsigned_le(CodedBitstreamContext *ctx, GetBitContext *g
CBS_TRACE_READ_END();
+ if (value < range_min || value > range_max) {
+ av_log(ctx->log_ctx, AV_LOG_ERROR,
+ "%s out of range: "
+ "%" PRIu32 ", but must be in [%" PRIu32 ",%" PRIu32 "].\n",
+ name, value, range_min, range_max);
+ return AVERROR_INVALIDDATA;
+ }
+
*write_to = value;
return 0;
}
@@ -246,15 +256,16 @@ static int cbs_vp8_read_unsigned_le(CodedBitstreamContext *ctx, GetBitContext *g
do { \
uint32_t value; \
CHECK(cbs_vp8_read_unsigned_le(ctx, rw, width, #name, \
- SUBSCRIPTS(subs, __VA_ARGS__), &value)); \
+ SUBSCRIPTS(subs, __VA_ARGS__), &value, \
+ 0, MAX_UINT_BITS(width))); \
current->name = value; \
} while (0)
#define fixed(width, name, value) \
do { \
uint32_t fixed_value; \
- CHECK(ff_cbs_read_unsigned(ctx, rw, width, #name, 0, &fixed_value, \
- value, value)); \
+ CHECK(cbs_vp8_read_unsigned_le(ctx, rw, width, #name, 0, &fixed_value, \
+ value, value)); \
} while (0)
#define bc_unsigned_subs(width, prob, enable_trace, name, subs, ...) \
@@ -277,6 +288,15 @@ static int cbs_vp8_read_unsigned_le(CodedBitstreamContext *ctx, GetBitContext *g
#include "cbs_vp8_syntax_template.c"
+#undef READ
+#undef READWRITE
+#undef RWContext
+#undef CBSVP8BoolCodingRW
+#undef xf
+#undef fixed
+#undef bc_unsigned_subs
+#undef bc_signed_subs
+
static int cbs_vp8_split_fragment(CodedBitstreamContext *ctx,
CodedBitstreamFragment *frag, int header)
{
@@ -327,9 +347,10 @@ static int cbs_vp8_read_unit(CodedBitstreamContext *ctx,
if (err < 0)
return err;
+ // Position may not be byte-aligned after compressed header; use bit-level
+ // comparison.
pos = get_bits_count(&gbc);
- pos /= 8;
- av_assert0(pos <= unit->data_size);
+ av_assert0(pos <= unit->data_size * 8);
frame->data_ref = av_buffer_ref(unit->data_ref);
if (!frame->data_ref)
This commit adds value range checks to cbs_vp8_read_unsigned_le, migrates fixed() to use it, and enforces little-endian consistency for all read methods. The VP8 compressed header may not be byte-aligned due to boolean coding. Use bitwise comparison to prevent the potential overread. TETS: ffmpeg -i fate-suite/vp8-test-vectors-r1/* -vcodec copy -bsf:v trace_headers -f null - Signed-off-by: Jianhui Dai <jianhui.j.dai@intel.com> --- libavcodec/cbs_vp8.c | 53 +++++++++++++++++++++++++++++++------------- 1 file changed, 37 insertions(+), 16 deletions(-)