From patchwork Tue Mar 17 14:53:58 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Fu, Linjie" X-Patchwork-Id: 18269 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id B75A2449D2E for ; Tue, 17 Mar 2020 16:59:17 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 9AF2F68A71D; Tue, 17 Mar 2020 16:59:17 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id C3EBC68A540 for ; Tue, 17 Mar 2020 16:59:10 +0200 (EET) IronPort-SDR: +RPdi+6GAE6K7cr+/kWKQPQdYRTZv+NkT2i7O2DxML878W5deOwzM3OXcdALN+6mq5tdPQU72q yuVOgZ8Niq8A== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga004.jf.intel.com ([10.7.209.38]) by orsmga106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Mar 2020 07:59:07 -0700 IronPort-SDR: qE+1Q7Did2brM3p9+LdpGwuIhMPEkeOw0/WN0tlqBwnIRI752Bqt0zNVTwBLzWt7vZUhN/Qkg+ RSBfrWzydmhA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,564,1574150400"; d="scan'208";a="391087667" Received: from icl-dev.sh.intel.com ([10.239.158.73]) by orsmga004.jf.intel.com with ESMTP; 17 Mar 2020 07:59:06 -0700 From: Linjie Fu To: ffmpeg-devel@ffmpeg.org Date: Tue, 17 Mar 2020 22:53:58 +0800 Message-Id: <1584456838-7151-1-git-send-email-linjie.fu@intel.com> X-Mailer: git-send-email 2.7.4 Subject: [FFmpeg-devel] [PATCH, v4] lavc/vp9: fix reference frame dimensions check for SINGLE_REFERENCE mode X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Linjie Fu MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" With the description in frame size with refs semantics (SPEC 7.2.5), it is a requirement of bitstream conformance that for at least one reference frame has the valid dimensions. Modify the check to make sure the decoder works well in SINGLE_REFERENCE mode that not all reference frames have valid dimensions. Check and error out if invalid reference frame is used in inter_recon. One of the failure case is a 480x272 inter frame (SINGLE_REFERENCE mode) with following reference pool: 0. 960x544 LAST valid 1. 1920x1088 GOLDEN invalid, but not used in single reference mode 2. 1920x1088 ALTREF invalid, but not used in single reference mode 3~7 ... Unused Identical logic in libvpx: Signed-off-by: Linjie Fu --- [v3]: replace assert with check/return, tested in both multi frame/slice mode [v4]: clear error_info to make decoding still work for other frames in this stream libavcodec/vp9.c | 20 ++++++++++++++++++-- libavcodec/vp9dec.h | 5 +++++ libavcodec/vp9recon.c | 10 ++++++++++ 3 files changed, 33 insertions(+), 2 deletions(-) diff --git a/libavcodec/vp9.c b/libavcodec/vp9.c index 7aaae9b..2b79dfd 100644 --- a/libavcodec/vp9.c +++ b/libavcodec/vp9.c @@ -794,6 +794,7 @@ static int decode_frame_header(AVCodecContext *avctx, /* check reference frames */ if (!s->s.h.keyframe && !s->s.h.intraonly) { + int valid_ref_frame = 0; for (i = 0; i < 3; i++) { AVFrame *ref = s->s.refs[s->s.h.refidx[i]].f; int refw = ref->width, refh = ref->height; @@ -807,17 +808,25 @@ static int decode_frame_header(AVCodecContext *avctx, } else if (refw == w && refh == h) { s->mvscale[i][0] = s->mvscale[i][1] = 0; } else { + /* Check to make sure at least one of frames that */ + /* this frame references has valid dimensions */ if (w * 2 < refw || h * 2 < refh || w > 16 * refw || h > 16 * refh) { - av_log(avctx, AV_LOG_ERROR, + av_log(avctx, AV_LOG_WARNING, "Invalid ref frame dimensions %dx%d for frame size %dx%d\n", refw, refh, w, h); - return AVERROR_INVALIDDATA; + s->mvscale[i][0] = s->mvscale[i][1] = REF_INVALID_SCALE; + continue; } s->mvscale[i][0] = (refw << 14) / w; s->mvscale[i][1] = (refh << 14) / h; s->mvstep[i][0] = 16 * s->mvscale[i][0] >> 14; s->mvstep[i][1] = 16 * s->mvscale[i][1] >> 14; } + valid_ref_frame++; + } + if (!valid_ref_frame) { + av_log(avctx, AV_LOG_ERROR, "No valid reference frame is found, bitstream not supported\n"); + return AVERROR_INVALIDDATA; } } @@ -1614,6 +1623,7 @@ FF_ENABLE_DEPRECATION_WARNINGS s->td[i].eob = s->td[i].eob_base; s->td[i].uveob[0] = s->td[i].uveob_base[0]; s->td[i].uveob[1] = s->td[i].uveob_base[1]; + s->td[i].error_info = 0; } #if HAVE_THREADS @@ -1670,6 +1680,12 @@ FF_ENABLE_DEPRECATION_WARNINGS } while (s->pass++ == 1); ff_thread_report_progress(&s->s.frames[CUR_FRAME].tf, INT_MAX, 0); + if (s->td->error_info < 0) { + av_log(avctx, AV_LOG_ERROR, "Failed to decode tile data\n"); + s->td->error_info = 0; + return AVERROR_INVALIDDATA; + } + finish: // ref frame setup for (i = 0; i < 8; i++) { diff --git a/libavcodec/vp9dec.h b/libavcodec/vp9dec.h index 66573ed..f2585c3 100644 --- a/libavcodec/vp9dec.h +++ b/libavcodec/vp9dec.h @@ -36,6 +36,8 @@ #include "vp9dsp.h" #include "vp9shared.h" +#define REF_INVALID_SCALE 0xFFFF + enum MVJoint { MV_JOINT_ZERO, MV_JOINT_H, @@ -217,6 +219,9 @@ struct VP9TileData { struct { int x, y; } min_mv, max_mv; int16_t *block_base, *block, *uvblock_base[2], *uvblock[2]; uint8_t *eob_base, *uveob_base[2], *eob, *uveob[2]; + + // error message + int error_info; }; void ff_vp9_fill_mv(VP9TileData *td, VP56mv *mv, int mode, int sb); diff --git a/libavcodec/vp9recon.c b/libavcodec/vp9recon.c index 49bb04e..9a4e7c7 100644 --- a/libavcodec/vp9recon.c +++ b/libavcodec/vp9recon.c @@ -572,6 +572,16 @@ static av_always_inline void inter_recon(VP9TileData *td, int bytesperpixel) VP9Block *b = td->b; int row = td->row, col = td->col; + if (s->mvscale[b->ref[0]][0] == REF_INVALID_SCALE || + (b->comp && s->mvscale[b->ref[1]][0] == REF_INVALID_SCALE)) { + if (!s->td->error_info) { + s->td->error_info = AVERROR_INVALIDDATA; + av_log(NULL, AV_LOG_ERROR, "Bitstream not supported, " + "reference frame has invalid dimensions\n"); + } + return; + } + if (s->mvscale[b->ref[0]][0] || (b->comp && s->mvscale[b->ref[1]][0])) { if (bytesperpixel == 1) { inter_pred_scaled_8bpp(td);