diff options
| author | chamarthi.kishore <chamarthi.kishore@ittiam.com> | 2023-03-01 19:22:01 +0530 |
|---|---|---|
| committer | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | 2023-03-01 15:01:00 -0800 |
| commit | 7855d6e872ce04398fbab460b8d8fdea39866b4d (patch) | |
| tree | bca194b195f1a04b6eaa15258f70839167e5a6b2 | |
| parent | 3a853e8247ce8e50df7e6a129adb29ab50dabb08 (diff) | |
| download | libavc-7855d6e872ce04398fbab460b8d8fdea39866b4d.tar.gz | |
svcdec: Bug fix in header and SPS parsing w.r.t non dyadic SVC decoding
BUG=oss-fuzz: 56176
Test: svc_dec_fuzzer
| -rw-r--r-- | decoder/svc/isvcd_parse_headers.c | 14 | ||||
| -rw-r--r-- | decoder/svc/isvcd_parse_slice.c | 10 |
2 files changed, 22 insertions, 2 deletions
diff --git a/decoder/svc/isvcd_parse_headers.c b/decoder/svc/isvcd_parse_headers.c index b549f4c..abf4a1b 100644 --- a/decoder/svc/isvcd_parse_headers.c +++ b/decoder/svc/isvcd_parse_headers.c @@ -603,8 +603,8 @@ WORD32 isvcd_parse_subset_sps(svc_dec_lyr_struct_t *ps_svc_lyr_dec, dec_bit_stre COPYTHECONTEXT("SPS_EXt: u1_extended_spatial_scalability_idc", ps_seq_svc_ext->u1_extended_spatial_scalability_idc); - /* u1_extended_spatial_scalability_idc value 0 is supported*/ - if(ps_seq_svc_ext->u1_extended_spatial_scalability_idc != 0) + /* u1_extended_spatial_scalability_idc value 0, 1 and 2 are supported */ + if(ps_seq_svc_ext->u1_extended_spatial_scalability_idc > 2) { return ERROR_SVC_INV_SUBSET_SPS; } @@ -661,6 +661,11 @@ WORD32 isvcd_parse_subset_sps(svc_dec_lyr_struct_t *ps_svc_lyr_dec, dec_bit_stre COPYTHECONTEXT("SPS_EXt: i4_seq_scaled_ref_layer_left_offset", ps_seq_svc_ext->i4_seq_scaled_ref_layer_left_offset); + if(ps_seq_svc_ext->i4_seq_scaled_ref_layer_left_offset != 0) + { + return ERROR_SVC_INV_SUBSET_SPS; + } + if(ps_seq_svc_ext->i4_seq_scaled_ref_layer_left_offset >= MAX_SCLD_REF_LAYER_OFFSET || ps_seq_svc_ext->i4_seq_scaled_ref_layer_left_offset < MIN_SCLD_REF_LAYER_OFFSET) { @@ -672,6 +677,11 @@ WORD32 isvcd_parse_subset_sps(svc_dec_lyr_struct_t *ps_svc_lyr_dec, dec_bit_stre COPYTHECONTEXT("SPS_EXt: i4_seq_scaled_ref_layer_top_offset", ps_seq_svc_ext->i4_seq_scaled_ref_layer_top_offset); + if(ps_seq_svc_ext->i4_seq_scaled_ref_layer_top_offset != 0) + { + return ERROR_SVC_INV_SUBSET_SPS; + } + if(ps_seq_svc_ext->i4_seq_scaled_ref_layer_top_offset >= MAX_SCLD_REF_LAYER_OFFSET || ps_seq_svc_ext->i4_seq_scaled_ref_layer_top_offset < MIN_SCLD_REF_LAYER_OFFSET) { diff --git a/decoder/svc/isvcd_parse_slice.c b/decoder/svc/isvcd_parse_slice.c index 464297d..f8270b6 100644 --- a/decoder/svc/isvcd_parse_slice.c +++ b/decoder/svc/isvcd_parse_slice.c @@ -1719,6 +1719,11 @@ WORD32 isvcd_parse_slice_header(svc_dec_lyr_struct_t *ps_svc_lyr_dec) COPYTHECONTEXT("Slice Header SVC ext: i4_scaled_ref_layer_left_offset", ps_svc_slice_params->i4_scaled_ref_layer_left_offset); + if(ps_svc_slice_params->i4_scaled_ref_layer_left_offset != 0) + { + return ERROR_INV_SLICE_HDR_T; + } + if(ps_svc_slice_params->i4_scaled_ref_layer_left_offset >= MAX_SCLD_REF_LAYER_OFFSET || ps_svc_slice_params->i4_scaled_ref_layer_left_offset < MIN_SCLD_REF_LAYER_OFFSET) { @@ -1730,6 +1735,11 @@ WORD32 isvcd_parse_slice_header(svc_dec_lyr_struct_t *ps_svc_lyr_dec) COPYTHECONTEXT("Slice Header SVC ext: i4_scaled_ref_layer_top_offset", ps_svc_slice_params->i4_scaled_ref_layer_top_offset); + if(ps_svc_slice_params->i4_scaled_ref_layer_top_offset != 0) + { + return ERROR_INV_SLICE_HDR_T; + } + if(ps_svc_slice_params->i4_scaled_ref_layer_top_offset >= MAX_SCLD_REF_LAYER_OFFSET || ps_svc_slice_params->i4_scaled_ref_layer_top_offset < MIN_SCLD_REF_LAYER_OFFSET) { |