From patchwork Tue Jan 9 15:14:44 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Dai, Jianhui J" X-Patchwork-Id: 45544 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:bf2f:b0:199:de12:6fa6 with SMTP id gc47csp456275pzb; Tue, 9 Jan 2024 07:15:23 -0800 (PST) X-Google-Smtp-Source: AGHT+IFQXNCAeUnNZCc1HCISUFNYsAj/lH7579DxwVN8etAW9mtNLtgxYUdnAa1sAvaq5ivnHLyl X-Received: by 2002:a2e:9d51:0:b0:2cd:c45:a2bd with SMTP id y17-20020a2e9d51000000b002cd0c45a2bdmr2427163ljj.37.1704813323472; Tue, 09 Jan 2024 07:15:23 -0800 (PST) Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id dn28-20020a05640222fc00b005572b72e0a1si834136edb.22.2024.01.09.07.15.03; Tue, 09 Jan 2024 07:15:23 -0800 (PST) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@intel.com header.s=Intel header.b=GzbytDkc; arc=fail (body hash mismatch); spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 7E49368CD82; Tue, 9 Jan 2024 17:14:59 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mgamail.intel.com (mgamail.intel.com [134.134.136.31]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id E183E68BEC2 for ; Tue, 9 Jan 2024 17:14:52 +0200 (EET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1704813298; x=1736349298; h=from:to:subject:date:message-id: content-transfer-encoding:mime-version; bh=BsqilIiEemgfIgzo9mBLVkV+QAsehdMlMWimRhwc/TU=; b=GzbytDkcXm6Tj+snaMIxeTcMXkGkXk4lm+D6DiKjXi/v646OEowZj5sX FCb95K+49ap0OdvHc3ldC17UmejalXfpJvCB6/GX2gQ+pgIRjrtjp5+Ds lQVIPhT8iiHXWOibjRyEf2qfjslHKWBKzXLPAgZ8Kfm9glkPWTgGBj/BL Vd0nQ8LZtWXHc87xhTaWGTFUKiEC378ZCnYbeJwBrpjGDmCXEb8wNfdD9 v1yBJT3RRvJUoAsoCNfjg6CG4fOQinwIyrc9a4qCWwA71kVl3xsDqeF7k mmcREN0d+zVKy+Ox1Gyu+QmNduFyppaRAfnTmEHVBDCQ4AIuZRPSte0F8 w==; X-IronPort-AV: E=McAfee;i="6600,9927,10947"; a="462505579" X-IronPort-AV: E=Sophos;i="6.04,183,1695711600"; d="scan'208";a="462505579" Received: from orsmga007.jf.intel.com ([10.7.209.58]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Jan 2024 07:14:49 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10947"; a="774884361" X-IronPort-AV: E=Sophos;i="6.04,183,1695711600"; d="scan'208";a="774884361" Received: from fmsmsx601.amr.corp.intel.com ([10.18.126.81]) by orsmga007.jf.intel.com with ESMTP/TLS/AES256-GCM-SHA384; 09 Jan 2024 07:14:49 -0800 Received: from fmsmsx612.amr.corp.intel.com (10.18.126.92) by fmsmsx601.amr.corp.intel.com (10.18.126.81) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35; Tue, 9 Jan 2024 07:14:48 -0800 Received: from FMSEDG603.ED.cps.intel.com (10.1.192.133) by fmsmsx612.amr.corp.intel.com (10.18.126.92) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35 via Frontend Transport; Tue, 9 Jan 2024 07:14:48 -0800 Received: from NAM10-BN7-obe.outbound.protection.outlook.com (104.47.70.101) by edgegateway.intel.com (192.55.55.68) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.35; Tue, 9 Jan 2024 07:14:48 -0800 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=bfjpyO4eW1Ai4zpgAGjD9LeH63hIYhY2tX/asN+6fTUhH7TxUNVAO/vAcujeFlFrgBNvh4bSGKVTJEnwCYoV/XhLvPqfZIeXealgjggoqPa/+dI8FMuUq41N3tJ3dKLWomj5RgEmA0/HbY6qgz4ELzhWoyPfQgkdYHHJw2FAlLZy4kTdI13/tQKZs6Zjn9RtC4U50BHVMOAat9QLBhVyvjonxLr1OgiU5XZYKJjl8pE6vuy3br2heLGur1n21FNzJqLoRNe2HQOojOT6SbZDJxQE1EMGLKsLwMjnqFsHQZCz7PY4dZdHC+Tt0QKAETjAEwoBJ+ZlBmwzUinyHK9rCQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=3CRlDoeahbfJsJC6DA4qgz1BYIfFfj2IxaFVi3wIC7w=; b=ajK01KT+GDk2pUqzS7p1nbt0zBwSQGrykP2owax3atuQJwihe9Gno7jmWmm9Yzb//n+ZlAB/0RjtP1AiTm1dMJEgFI5ZfSD8+oJLuKx+Zuhhjsg/2fR7nk+xt4PXqiVXlgSXvEryOGKD+qL5hwfcyf9ZNS/H3tEHsHghLdDXOOHcLcoM+x5lXHlwo12AP/XXtK50OF8tSbwDm0l/RHpQKs7CleVRspC4cfZE1noANpf67AzgqKnCFnoxY52PhyT4/KQlzRw8Lz8Oxr3M9zCX32FL11G7TvZX+V7ejdK68tNxJ1Di9Q/NxC+xmfIm9/sGti1IHQ/rpp2EEVmS+oS8jw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none Received: from CH3PR11MB7937.namprd11.prod.outlook.com (2603:10b6:610:12c::15) by PH0PR11MB5077.namprd11.prod.outlook.com (2603:10b6:510:3b::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7159.23; Tue, 9 Jan 2024 15:14:45 +0000 Received: from CH3PR11MB7937.namprd11.prod.outlook.com ([fe80::36df:9084:c6e3:6845]) by CH3PR11MB7937.namprd11.prod.outlook.com ([fe80::36df:9084:c6e3:6845%4]) with mapi id 15.20.7159.020; Tue, 9 Jan 2024 15:14:44 +0000 From: "Dai, Jianhui J" To: "ffmpeg-devel@ffmpeg.org" Thread-Topic: [PATCH v4] avcodec/cbs_vp8: Use little endian in fixed() and improve the pos check Thread-Index: AdoxhcxesZ1ySviTRKC7NZLDZiqoaA== Date: Tue, 9 Jan 2024 15:14:44 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=intel.com; x-ms-exchange-messagesentrepresentingtype: 1 x-ms-publictraffictype: Email x-ms-traffictypediagnostic: CH3PR11MB7937:EE_|PH0PR11MB5077:EE_ x-ms-office365-filtering-correlation-id: b264a0a2-cbe5-4830-b513-08dc1125b646 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: EYNfn4tTscZm/40HNT5dE+I5BBt0to+r5ZyHLdpe61AKvCkGKk6HVJVAeJnAa8A6MsZP+6Zf63jJ9j2SsMfFOOPt69TmACOrwOCwI1a4O+0T5wvqHRhkjyKhO9t74E4AkfAY24Uuq9D2w1Hd/KmBOCRj/X3bmandK0dWa8h7TsbGjvqWQYnauqREc5gb20Gb3RwEHMsET4catC7rxGLqyTCE4KK1lo9mpn6ieIXHb4Zp7pKDOlK9q/qk0J1trlUWWga15z/jPtX/sO/o3RcLHMmtYMkT6E+UEQZXje8hZJsai1QcB5xGBMTocyqAiSe8QL5GSJ7z8WU4LO+FlN4P0BCiNj8owcM161TCcfus/11HcTE5sKUH2yuT2/8dkmAsIlpIe78msW/bt1Tw5G/h4ndjLrUwh+teWwtBuIliJjBLGU5qsxodPsoc12frde0yaAKXmTKkekPuw4FQwyEzPcXZv7Sra71VKot09yPAVKHMsHzutLqjzwbE7twEvanx/MiHMGKR7l9F3g6+RL7/rrxbnjuUZ79RSSbVmY5Vkl5zZ6VoWqEQSO01KvK2Cs4AXJIooBrMkZ+aznLUwiCtut/HagcyeGY9jogdVvCtww3xCnlMBEuYYtPAxBl9o8Py x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH3PR11MB7937.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230031)(396003)(346002)(376002)(366004)(39860400002)(136003)(230922051799003)(451199024)(186009)(64100799003)(1800799012)(41300700001)(7696005)(83380400001)(6506007)(55016003)(33656002)(478600001)(2906002)(38070700009)(66446008)(6916009)(76116006)(66476007)(316002)(66946007)(64756008)(38100700002)(26005)(122000001)(9686003)(71200400001)(82960400001)(66556008)(86362001)(52536014)(19627235002)(8676002)(5660300002)(8936002); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: lNZRQ9qI3JrQrxoNHVXCDYtKKgeQ1ESgI2iAfCOB5QS+4MrMHvdxvGOFt8/3W+Iv7bV63ziB4nY28vhGI19gW9+wc6lg290ILeplYU07Z94jv1WSTmgVDe5l6fcl9fiDK4j8ZkwVd2omUhGU3gQFalcGwUsFbXSEuM+WeRaWG5rukJACfWrMylxmVl9JVuSsiMUbunHx+2hj5ZVQM3O5J2wXUT8pG2FJIwVazAY8BiyENyP3j97FHvaP+l9oc790ChzYEeHdI8MvDseLz5F9IglFSZuzqrlewktDUpPGABlxM/OFFb1CaxlKNlAiWuo22E2iDN5f5jNUEbamea5Zf2vn/UQXqGuP0NLylKC2r3HEtuTxO8VvsPCSTU7cvibTvTUXaCIUK2dZg+iDfwlZBShnwS0UJHCsbfK5JtalVfQEddDF35sA6c5hOJUXSFegOiDojiEf5I63pUQrMm/O/8VSdyrRrHEIu2E1cJLbLsrlcxEtchytxn/8wGgY/2ISKjjmK44eqCDM+NijqJ1iwfbd0e0A0wjFc2L6LprQ98jVPAF3Q2+4YtK43MGEyY8vzO/kJzvXn2W2ghA81hznK4xeIoqr49WdZ9NWSKNtBG3+EOXMmrJu5A+fDt+Mj2veYe6F/2pqEtTYRZqfUZQmkRvH1fD2gufwNlx7jrhsDJr6qwo9C0oQjgzDdugQbdf5u1Bw0lhE17XpY7/r1vhPxUux+qbLkZ6HyC4JnUBptWwF96tdw42KD8+RMgPixXLEON2x580zTW32hGdhwboSGI59CM8z5+ziHC2wXdCWktd3eg40iW/kSpMikxePrtDRL3C93x1jAXBVAmwMRtMrN3Q0KOh9MwQU/HbbDnzVTpZ+Ghx9+pH9yOr9aI2ssnr3P1wVv0tCkgJL3RGmMoLbBG8k0dgVYnEYJSU+ipNl+uINFbxXQlV9TYuXB/hBt8+/gsSsQ9CX0+h28XJTXyi+DOos/lazT4+H6X0zT7KSzY76KmR0LqlAhBOiU/cVvgP97alkElTWihrvXVskuXBx27Ta+zLon5cUsYLe0zgi3F+1tAkrNSJl600N+FtW45GqMwP1QmFMLR8UjZAVQRBjRJH9Zru157ZboOQRPzHn+TmBmdIwCniKBLRb/1VD+Ck7SZkqxI68SdFjSAwMy1PiLILzZmBLDbM+qNklTg+8NuTnUfzuCLVunPauV0lap5tvhU3uptiXRxbMlq6QUUVQnM2GPG92yYpbnIU+yStF7wDQfMSngr+FB/ARUhoWPi+3zZFenUERtwmBdPjsyPiBqao0WhJbYLoiY0DmVXRyhAFZiv8gzzZEBIO0c9T6MtPnlKoevQAMaL/GCu2NCRlmZxeixGN1n3R8ArI6wavsCsjjNl8qz4j+Xegtx8UembUYbwCSuWcA0D/Z8js3PZWG8aLls/A3aQn6xFAq5Odmnw1Bg2/rIYPtkTVRlEtMQ4wRixbGZuaUF2l9XRTYs3X/w7hPBcD4SK/SWPyFbDZ+p0/hSE9YD8V4ukgpIyXjI6lIsIA/SHkh76Eet0rOeogApFbeYN48Pr9FvJUhdu3TznO/RHOOgxDWCCxrc6yBUA/S MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: CH3PR11MB7937.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: b264a0a2-cbe5-4830-b513-08dc1125b646 X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Jan 2024 15:14:44.8970 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: avIzzTU5DMrOurgiFQuVhZsdRSKVJhwoBAw79u2XB3TTBi1YiwqoS87osWFJ3CJ7SG6gQ3muYEpZOKF1JVWQoA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR11MB5077 X-OriginatorOrg: intel.com Subject: [FFmpeg-devel] [PATCH v4] avcodec/cbs_vp8: Use little endian in fixed() and improve the pos check X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: wjVMMQF87A2N This commit adds value range checks to cbs_vp8_read_unsigned_le, migrates fixed() to use it, and enforces little-endian consistency for all read methods. The VP8 compressed header may not be byte-aligned due to boolean coding. Use bitwise comparison to prevent the potential overread. TETS: ffmpeg -i fate-suite/vp8-test-vectors-r1/* -vcodec copy -bsf:v trace_headers -f null - Signed-off-by: Jianhui Dai --- libavcodec/cbs_vp8.c | 53 +++++++++++++++++++++++++++++++------------- 1 file changed, 37 insertions(+), 16 deletions(-) diff --git a/libavcodec/cbs_vp8.c b/libavcodec/cbs_vp8.c index 065156c248..338d56ed7f 100644 --- a/libavcodec/cbs_vp8.c +++ b/libavcodec/cbs_vp8.c @@ -33,22 +33,22 @@ extern const uint8_t ff_vp8_token_update_probs[4][8][3][11]; typedef struct CBSVP8BoolDecoder { GetBitContext *gbc; - uint8_t value; uint8_t range; - uint8_t count; // Store the number of bits in the `value` buffer. - + uint8_t value; + // Store the number of bits in the `value` buffer. + uint8_t count; } CBSVP8BoolDecoder; -static int cbs_vp8_bool_decoder_init(CBSVP8BoolDecoder *decoder, GetBitContext *gbc) +static int cbs_vp8_bool_decoder_init(CBSVP8BoolDecoder *decoder, + GetBitContext *gbc) { av_assert0(decoder); av_assert0(gbc); decoder->gbc = gbc; - decoder->value = 0; decoder->range = 255; - + decoder->value = 0; decoder->count = 0; return 0; @@ -60,7 +60,7 @@ static bool cbs_vp8_bool_decoder_fill_value(CBSVP8BoolDecoder *decoder) av_assert0(decoder->count <= 8); if (decoder->count == 8) { - return true; + return true; } if (get_bits_left(decoder->gbc) >= bits) { @@ -141,7 +141,7 @@ static int cbs_vp8_bool_decoder_read_unsigned( } if (trace_enable) { - CBS_TRACE_READ_END(); + CBS_TRACE_READ_END(); } *write_to = value; @@ -181,9 +181,11 @@ static int cbs_vp8_bool_decoder_read_signed( return 0; } -static int cbs_vp8_read_unsigned_le(CodedBitstreamContext *ctx, GetBitContext *gbc, - int width, const char *name, - const int *subscripts, uint32_t *write_to) +static int cbs_vp8_read_unsigned_le(CodedBitstreamContext *ctx, + GetBitContext *gbc, int width, + const char *name, const int *subscripts, + uint32_t *write_to, uint32_t range_min, + uint32_t range_max) { int32_t value; @@ -200,6 +202,14 @@ static int cbs_vp8_read_unsigned_le(CodedBitstreamContext *ctx, GetBitContext *g CBS_TRACE_READ_END(); + if (value < range_min || value > range_max) { + av_log(ctx->log_ctx, AV_LOG_ERROR, + "%s out of range: " + "%" PRIu32 ", but must be in [%" PRIu32 ",%" PRIu32 "].\n", + name, value, range_min, range_max); + return AVERROR_INVALIDDATA; + } + *write_to = value; return 0; } @@ -246,15 +256,16 @@ static int cbs_vp8_read_unsigned_le(CodedBitstreamContext *ctx, GetBitContext *g do { \ uint32_t value; \ CHECK(cbs_vp8_read_unsigned_le(ctx, rw, width, #name, \ - SUBSCRIPTS(subs, __VA_ARGS__), &value)); \ + SUBSCRIPTS(subs, __VA_ARGS__), &value, \ + 0, MAX_UINT_BITS(width))); \ current->name = value; \ } while (0) #define fixed(width, name, value) \ do { \ uint32_t fixed_value; \ - CHECK(ff_cbs_read_unsigned(ctx, rw, width, #name, 0, &fixed_value, \ - value, value)); \ + CHECK(cbs_vp8_read_unsigned_le(ctx, rw, width, #name, 0, &fixed_value, \ + value, value)); \ } while (0) #define bc_unsigned_subs(width, prob, enable_trace, name, subs, ...) \ @@ -277,6 +288,15 @@ static int cbs_vp8_read_unsigned_le(CodedBitstreamContext *ctx, GetBitContext *g #include "cbs_vp8_syntax_template.c" +#undef READ +#undef READWRITE +#undef RWContext +#undef CBSVP8BoolCodingRW +#undef xf +#undef fixed +#undef bc_unsigned_subs +#undef bc_signed_subs + static int cbs_vp8_split_fragment(CodedBitstreamContext *ctx, CodedBitstreamFragment *frag, int header) { @@ -327,9 +347,10 @@ static int cbs_vp8_read_unit(CodedBitstreamContext *ctx, if (err < 0) return err; + // Position may not be byte-aligned after compressed header; use bit-level + // comparison. pos = get_bits_count(&gbc); - pos /= 8; - av_assert0(pos <= unit->data_size); + av_assert0(pos <= unit->data_size * 8); frame->data_ref = av_buffer_ref(unit->data_ref); if (!frame->data_ref)