aboutsummaryrefslogtreecommitdiff
path: root/decoder
diff options
context:
space:
mode:
Diffstat (limited to 'decoder')
-rw-r--r--decoder/ihevcd_api.c22
-rw-r--r--decoder/ihevcd_bitstream.c2
-rw-r--r--decoder/ihevcd_cxa.h5
-rw-r--r--decoder/ihevcd_decode.c10
-rw-r--r--decoder/ihevcd_get_mv.c8
-rw-r--r--decoder/ihevcd_nal.c2
-rw-r--r--decoder/ihevcd_parse_headers.c398
-rw-r--r--decoder/ihevcd_parse_residual.c4
-rw-r--r--decoder/ihevcd_parse_slice.c8
-rw-r--r--decoder/ihevcd_parse_slice_header.c121
-rw-r--r--decoder/ihevcd_process_slice.c8
-rw-r--r--decoder/ihevcd_ref_list.c2
-rw-r--r--decoder/ihevcd_sao.c30
13 files changed, 480 insertions, 140 deletions
diff --git a/decoder/ihevcd_api.c b/decoder/ihevcd_api.c
index 8abef0f..134ed31 100644
--- a/decoder/ihevcd_api.c
+++ b/decoder/ihevcd_api.c
@@ -1169,6 +1169,7 @@ WORD32 ihevcd_allocate_static_bufs(iv_obj_t **pps_codec_obj,
pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, sizeof(iv_obj_t));
RETURN_IF((NULL == pv_buf), IV_FAIL);
+ memset(pv_buf, 0, sizeof(iv_obj_t));
*pps_codec_obj = (iv_obj_t *)pv_buf;
ps_create_op->s_ivd_create_op_t.pv_handle = *pps_codec_obj;
@@ -1205,6 +1206,7 @@ WORD32 ihevcd_allocate_static_bufs(iv_obj_t **pps_codec_obj,
size = MAX_PROCESS_THREADS * ithread_get_handle_size();
pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
RETURN_IF((NULL == pv_buf), IV_FAIL);
+ memset(pv_buf, 0, size);
for(i = 0; i < MAX_PROCESS_THREADS; i++)
{
@@ -1217,6 +1219,7 @@ WORD32 ihevcd_allocate_static_bufs(iv_obj_t **pps_codec_obj,
size = MIN_BITSBUF_SIZE;
pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size + 16); //Alloc extra for parse optimization
RETURN_IF((NULL == pv_buf), IV_FAIL);
+ memset(pv_buf, 0, size + 16);
ps_codec->pu1_bitsbuf_static = pv_buf;
ps_codec->u4_bitsbuf_size_static = size;
@@ -1224,24 +1227,28 @@ WORD32 ihevcd_allocate_static_bufs(iv_obj_t **pps_codec_obj,
size = sizeof(buf_mgr_t);
pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
RETURN_IF((NULL == pv_buf), IV_FAIL);
+ memset(pv_buf, 0, size);
ps_codec->pv_disp_buf_mgr = pv_buf;
/* size for holding dpb manager context */
size = sizeof(dpb_mgr_t);
pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
RETURN_IF((NULL == pv_buf), IV_FAIL);
+ memset(pv_buf, 0, size);
ps_codec->pv_dpb_mgr = pv_buf;
/* size for holding buffer manager context */
size = sizeof(buf_mgr_t);
pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
RETURN_IF((NULL == pv_buf), IV_FAIL);
+ memset(pv_buf, 0, size);
ps_codec->pv_pic_buf_mgr = pv_buf;
/* size for holding mv buffer manager context */
size = sizeof(buf_mgr_t);
pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
RETURN_IF((NULL == pv_buf), IV_FAIL);
+ memset(pv_buf, 0, size);
ps_codec->pv_mv_buf_mgr = pv_buf;
size = MAX_VPS_CNT * sizeof(vps_t);
@@ -1277,6 +1284,7 @@ WORD32 ihevcd_allocate_static_bufs(iv_obj_t **pps_codec_obj,
size = (MAX_SPS_CNT + MAX_PPS_CNT) * size * sizeof(WORD16);
pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
RETURN_IF((NULL == pv_buf), IV_FAIL);
+ memset(pv_buf, 0, size);
ps_codec->pi2_scaling_mat = (WORD16 *)pv_buf;
@@ -1287,6 +1295,7 @@ WORD32 ihevcd_allocate_static_bufs(iv_obj_t **pps_codec_obj,
size = BUF_MGR_MAX_CNT * sizeof(pic_buf_t);
pv_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
RETURN_IF((NULL == pv_buf), IV_FAIL);
+ memset(pv_buf, 0, size);
ps_codec->pv_pic_buf_base = (UWORD8 *)pv_buf;
/* TO hold scratch buffers needed for each SAO context */
@@ -1298,6 +1307,7 @@ WORD32 ihevcd_allocate_static_bufs(iv_obj_t **pps_codec_obj,
pu1_buf = pf_aligned_alloc(pv_mem_ctxt, 128, size);
RETURN_IF((NULL == pu1_buf), IV_FAIL);
+ memset(pu1_buf, 0, size);
for(i = 0; i < MAX_PROCESS_THREADS; i++)
{
@@ -1607,6 +1617,7 @@ WORD32 ihevcd_allocate_dynamic_bufs(codec_t *ps_codec)
pv_buf = ps_codec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
RETURN_IF((NULL == pv_buf), IV_FAIL);
+ memset(pv_buf, 0, size);
ps_codec->pv_proc_jobq_buf = pv_buf;
ps_codec->i4_proc_jobq_buf_size = size;
@@ -1914,6 +1925,7 @@ WORD32 ihevcd_allocate_dynamic_bufs(codec_t *ps_codec)
{
pv_buf = ps_codec->pf_aligned_alloc(pv_mem_ctxt, 128, size + 16); //Alloc extra for parse optimization
RETURN_IF((NULL == pv_buf), IV_FAIL);
+ memset(pv_buf, 0, size + 16);
ps_codec->pu1_bitsbuf_dynamic = pv_buf;
ps_codec->u4_bitsbuf_size_dynamic = size;
}
@@ -1950,6 +1962,7 @@ WORD32 ihevcd_allocate_dynamic_bufs(codec_t *ps_codec)
pv_buf = ps_codec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
RETURN_IF((NULL == pv_buf), IV_FAIL);
+ memset(pv_buf, 0, size);
ps_codec->pv_mv_bank_buf_base = pv_buf;
ps_codec->i4_total_mv_bank_size = size;
@@ -1969,7 +1982,7 @@ WORD32 ihevcd_allocate_dynamic_bufs(codec_t *ps_codec)
size = ihevcd_get_total_pic_buf_size(ps_codec, wd, ht);
pv_buf = ps_codec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
RETURN_IF((NULL == pv_buf), IV_FAIL);
-
+ memset(pv_buf, 0, size);
ps_codec->i4_total_pic_buf_size = size;
ps_codec->pu1_ref_pic_buf_base = (UWORD8 *)pv_buf;
@@ -2112,7 +2125,7 @@ WORD32 ihevcd_create(iv_obj_t *ps_codec_obj,
}
}
ps_create_op->s_ivd_create_op_t.u4_error_code = IVD_MEM_ALLOC_FAILED;
- ps_create_op->s_ivd_create_op_t.u4_error_code = 1 << IVD_FATALERROR;
+ ps_create_op->s_ivd_create_op_t.u4_error_code |= 1 << IVD_FATALERROR;
return IV_FAIL;
}
@@ -2229,6 +2242,7 @@ WORD32 ihevcd_set_display_frame(iv_obj_t *ps_codec_obj,
pu1_chroma_buf = ps_codec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
RETURN_IF((NULL == pu1_chroma_buf), IV_FAIL);
+ memset(pu1_chroma_buf, 0, size);
ps_codec->pu1_cur_chroma_ref_buf = pu1_chroma_buf;
}
@@ -3140,7 +3154,7 @@ WORD32 ihevcd_get_vui_params(iv_obj_t *ps_codec_obj,
ps_op->u4_vui_num_units_in_tick = ps_vui->u4_vui_num_units_in_tick;
ps_op->u4_vui_time_scale = ps_vui->u4_vui_time_scale;
ps_op->u1_poc_proportional_to_timing_flag = ps_vui->u1_poc_proportional_to_timing_flag;
- ps_op->u1_num_ticks_poc_diff_one_minus1 = ps_vui->u1_num_ticks_poc_diff_one_minus1;
+ ps_op->u4_num_ticks_poc_diff_one_minus1 = ps_vui->u4_num_ticks_poc_diff_one_minus1;
ps_op->u1_bitstream_restriction_flag = ps_vui->u1_bitstream_restriction_flag;
ps_op->u1_tiles_fixed_structure_flag = ps_vui->u1_tiles_fixed_structure_flag;
ps_op->u1_motion_vectors_over_pic_boundaries_flag = ps_vui->u1_motion_vectors_over_pic_boundaries_flag;
@@ -3175,7 +3189,7 @@ WORD32 ihevcd_get_vui_params(iv_obj_t *ps_codec_obj,
{
ps_op->au1_fixed_pic_rate_general_flag[i] = ps_vui->s_vui_hrd_parameters.au1_fixed_pic_rate_general_flag[i];
ps_op->au1_fixed_pic_rate_within_cvs_flag[i] = ps_vui->s_vui_hrd_parameters.au1_fixed_pic_rate_within_cvs_flag[i];
- ps_op->au1_elemental_duration_in_tc_minus1[i] = ps_vui->s_vui_hrd_parameters.au1_elemental_duration_in_tc_minus1[i];
+ ps_op->au2_elemental_duration_in_tc_minus1[i] = ps_vui->s_vui_hrd_parameters.au2_elemental_duration_in_tc_minus1[i];
ps_op->au1_low_delay_hrd_flag[i] = ps_vui->s_vui_hrd_parameters.au1_low_delay_hrd_flag[i];
ps_op->au1_cpb_cnt_minus1[i] = ps_vui->s_vui_hrd_parameters.au1_cpb_cnt_minus1[i];
}
diff --git a/decoder/ihevcd_bitstream.c b/decoder/ihevcd_bitstream.c
index 3b8d24f..21f1b2e 100644
--- a/decoder/ihevcd_bitstream.c
+++ b/decoder/ihevcd_bitstream.c
@@ -247,8 +247,8 @@ void ihevcd_bits_seek(bitstrm_t *ps_bitstrm, WORD32 numbits)
* then subtract abs_numbits from offset and add 32 and move cur_word to nxt_word
* and load cur_word appropriately and decrement pu4_buf
*/
- ps_bitstrm->u4_bit_ofst -= abs_numbits;
ps_bitstrm->u4_bit_ofst += 32;
+ ps_bitstrm->u4_bit_ofst -= abs_numbits;
ps_bitstrm->pu4_buf--;
val = *(ps_bitstrm->pu4_buf - 2);
diff --git a/decoder/ihevcd_cxa.h b/decoder/ihevcd_cxa.h
index 21b2023..f81a7eb 100644
--- a/decoder/ihevcd_cxa.h
+++ b/decoder/ihevcd_cxa.h
@@ -45,6 +45,7 @@ extern "C" {
/*****************************************************************************/
/* Constant Macros */
/*****************************************************************************/
+#define IVD_ERROR_MASK 0xFF
/*****************************************************************************/
/* Function Macros */
@@ -787,7 +788,7 @@ typedef struct {
* num_ticks_poc_diff_one_minus1 plus 1 specifies the number of clock ticks
* corresponding to a difference of poc values equal to 1
*/
- UWORD8 u1_num_ticks_poc_diff_one_minus1;
+ UWORD32 u4_num_ticks_poc_diff_one_minus1;
/**
* 1, specifies that the following cvs bitstream restriction parameters are present
@@ -955,7 +956,7 @@ typedef struct {
* element units that specify HRD output times of consecutive pictures in output order is constrained
* refer to Table E-6
*/
- UWORD8 au1_elemental_duration_in_tc_minus1[6];
+ UWORD16 au2_elemental_duration_in_tc_minus1[6];
/**
* specifies the HRD operational mode
diff --git a/decoder/ihevcd_decode.c b/decoder/ihevcd_decode.c
index d2ea7a5..1295687 100644
--- a/decoder/ihevcd_decode.c
+++ b/decoder/ihevcd_decode.c
@@ -137,6 +137,10 @@ static UWORD32 ihevcd_map_error(IHEVCD_ERROR_T e_error)
case IHEVCD_NUM_EXTRA_DISP_UNSUPPORTED:
case IHEVCD_INSUFFICIENT_MEM_MVBANK:
case IHEVCD_INSUFFICIENT_MEM_PICBUF:
+ case IHEVCD_UNSUPPORTED_CHROMA_FMT_IDC:
+ case IHEVCD_UNSUPPORTED_BIT_DEPTH:
+ case IVD_MEM_ALLOC_FAILED:
+ case IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED:
error_code |= 1 << IVD_FATALERROR;
break;
case IHEVCD_INVALID_DISP_STRD:
@@ -144,8 +148,6 @@ static UWORD32 ihevcd_map_error(IHEVCD_ERROR_T e_error)
case IHEVCD_UNSUPPORTED_VPS_ID:
case IHEVCD_UNSUPPORTED_SPS_ID:
case IHEVCD_UNSUPPORTED_PPS_ID:
- case IHEVCD_UNSUPPORTED_CHROMA_FMT_IDC:
- case IHEVCD_UNSUPPORTED_BIT_DEPTH:
case IHEVCD_BUF_MGR_ERROR:
case IHEVCD_NO_FREE_MVBANK:
case IHEVCD_NO_FREE_PICBUF:
@@ -389,6 +391,8 @@ WORD32 ihevcd_decode(iv_obj_t *ps_codec_obj, void *pv_api_ip, void *pv_api_op)
/* Initialize error code */
ps_codec->i4_error_code = 0;
+ /* Initialize bytes remaining */
+ ps_codec->i4_bytes_remaining = 0;
ps_dec_ip = (ivd_video_decode_ip_t *)pv_api_ip;
ps_dec_op = (ivd_video_decode_op_t *)pv_api_op;
@@ -715,7 +719,7 @@ WORD32 ihevcd_decode(iv_obj_t *ps_codec_obj, void *pv_api_ip, void *pv_api_op)
/* Free any dynamic buffers that are allocated */
ihevcd_free_dynamic_bufs(ps_codec);
ps_codec->i4_error_code = IVD_MEM_ALLOC_FAILED;
- ps_dec_op->u4_error_code |= 1 << IVD_FATALERROR;
+ ps_dec_op->u4_error_code = 1 << IVD_FATALERROR;
ps_dec_op->u4_error_code |= IVD_MEM_ALLOC_FAILED;
return IV_FAIL;
diff --git a/decoder/ihevcd_get_mv.c b/decoder/ihevcd_get_mv.c
index 25ddbd9..5914ed4 100644
--- a/decoder/ihevcd_get_mv.c
+++ b/decoder/ihevcd_get_mv.c
@@ -509,13 +509,17 @@ WORD32 ihevcd_get_mv_ctb(mv_ctxt_t *ps_mv_ctxt,
WORD32 ctb_row, ctb_col, index_pic_map, index_nbr_map;
WORD32 first_pu_of_ctb;
first_pu_of_ctb = pu4_nbr_pu_idx[1 + nbr_pu_idx_strd];
+ UWORD32 cur_ctb_ht_in_min_pu = MIN(((ps_sps->i2_pic_height_in_luma_samples
+ - (ps_mv_ctxt->i4_ctb_y << ps_sps->i1_log2_ctb_size)) / MIN_PU_SIZE), ctb_size_in_min_pu);
+ UWORD32 cur_ctb_wd_in_min_pu = MIN(((ps_sps->i2_pic_width_in_luma_samples
+ - (ps_mv_ctxt->i4_ctb_x << ps_sps->i1_log2_ctb_size)) / MIN_PU_SIZE), ctb_size_in_min_pu);
index_pic_map = 0 * ctb_size_in_min_pu + 0;
index_nbr_map = (0 + 1) * nbr_pu_idx_strd + (0 + 1);
- for(ctb_row = 0; ctb_row < ctb_size_in_min_pu; ctb_row++)
+ for(ctb_row = 0; ctb_row < cur_ctb_ht_in_min_pu; ctb_row++)
{
- for(ctb_col = 0; ctb_col < ctb_size_in_min_pu; ctb_col++)
+ for(ctb_col = 0; ctb_col < cur_ctb_wd_in_min_pu; ctb_col++)
{
pu1_pic_pu_map_ctb[index_pic_map + ctb_col] = pu4_nbr_pu_idx[index_nbr_map + ctb_col]
- first_pu_of_ctb;
diff --git a/decoder/ihevcd_nal.c b/decoder/ihevcd_nal.c
index d00050d..18d9a5d 100644
--- a/decoder/ihevcd_nal.c
+++ b/decoder/ihevcd_nal.c
@@ -301,7 +301,7 @@ IHEVCD_ERROR_T ihevcd_nal_unit_header(bitstrm_t *ps_bitstrm, nal_header_t *ps_na
unused = ihevcd_bits_get(ps_bitstrm, 6);
/* Syntax : nuh_temporal_id_plus1 */
- ps_nal->i1_nuh_temporal_id = ihevcd_bits_get(ps_bitstrm, 3) - 1;
+ ps_nal->i1_nuh_temporal_id = (WORD32)ihevcd_bits_get(ps_bitstrm, 3) - 1;
return ret;
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index 09f343c..e16a9e6 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -42,6 +42,8 @@
#include <stdlib.h>
#include <string.h>
#include <assert.h>
+#include <limits.h>
+#include <stdint.h>
#include "ihevc_typedefs.h"
#include "iv.h"
@@ -150,17 +152,27 @@ WORD32 ihevcd_parse_pred_wt_ofst(bitstrm_t *ps_bitstrm,
{
IHEVCD_ERROR_T ret = (IHEVCD_ERROR_T)IHEVCD_SUCCESS;
WORD32 value;
+ UWORD32 u4_value;
WORD32 i;
pred_wt_ofst_t *ps_wt_ofst = &ps_slice_hdr->s_wt_ofst;
UNUSED(ps_pps);
- UEV_PARSE("luma_log2_weight_denom", value, ps_bitstrm);
- ps_wt_ofst->i1_luma_log2_weight_denom = value;
+ UEV_PARSE("luma_log2_weight_denom", u4_value, ps_bitstrm);
+ if(u4_value > 7)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+ ps_wt_ofst->i1_luma_log2_weight_denom = u4_value;
if(ps_sps->i1_chroma_format_idc != 0)
{
SEV_PARSE("delta_chroma_log2_weight_denom", value, ps_bitstrm);
+ if(((ps_wt_ofst->i1_luma_log2_weight_denom + value) < 0) ||
+ ((ps_wt_ofst->i1_luma_log2_weight_denom + value) > 7))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_wt_ofst->i1_chroma_log2_weight_denom = ps_wt_ofst->i1_luma_log2_weight_denom + value;
}
@@ -194,11 +206,18 @@ WORD32 ihevcd_parse_pred_wt_ofst(bitstrm_t *ps_bitstrm,
if(ps_wt_ofst->i1_luma_weight_l0_flag[i])
{
SEV_PARSE("delta_luma_weight_l0[ i ]", value, ps_bitstrm);
-
+ if( value < -128 || value > 127 )
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_wt_ofst->i2_luma_weight_l0[i] = (1 << ps_wt_ofst->i1_luma_log2_weight_denom) + value;
SEV_PARSE("luma_offset_l0[ i ]", value, ps_bitstrm);
+ if( value < -128 || value > 127 )
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_wt_ofst->i2_luma_offset_l0[i] = value;
}
@@ -212,20 +231,36 @@ WORD32 ihevcd_parse_pred_wt_ofst(bitstrm_t *ps_bitstrm,
WORD32 ofst;
WORD32 shift = (1 << (BIT_DEPTH_CHROMA - 1));
SEV_PARSE("delta_chroma_weight_l0[ i ][ j ]", value, ps_bitstrm);
+ if(value < -128 || value > 127)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_wt_ofst->i2_chroma_weight_l0_cb[i] = (1 << ps_wt_ofst->i1_chroma_log2_weight_denom) + value;
SEV_PARSE("delta_chroma_offset_l0[ i ][ j ]", value, ps_bitstrm);
+ if( value < -512 || value > 511 )
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ofst = ((shift * ps_wt_ofst->i2_chroma_weight_l0_cb[i]) >> ps_wt_ofst->i1_chroma_log2_weight_denom);
ofst = value - ofst + shift;
ps_wt_ofst->i2_chroma_offset_l0_cb[i] = CLIP_S8(ofst);
SEV_PARSE("delta_chroma_weight_l0[ i ][ j ]", value, ps_bitstrm);
+ if(value < -128 || value > 127)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_wt_ofst->i2_chroma_weight_l0_cr[i] = (1 << ps_wt_ofst->i1_chroma_log2_weight_denom) + value;
SEV_PARSE("delta_chroma_offset_l0[ i ][ j ]", value, ps_bitstrm);
+ if( value < -512 || value > 511 )
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ofst = ((shift * ps_wt_ofst->i2_chroma_weight_l0_cr[i]) >> ps_wt_ofst->i1_chroma_log2_weight_denom);
ofst = value - ofst + shift;
@@ -270,11 +305,18 @@ WORD32 ihevcd_parse_pred_wt_ofst(bitstrm_t *ps_bitstrm,
if(ps_wt_ofst->i1_luma_weight_l1_flag[i])
{
SEV_PARSE("delta_luma_weight_l1[ i ]", value, ps_bitstrm);
-
+ if( value < -128 || value > 127 )
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_wt_ofst->i2_luma_weight_l1[i] = (1 << ps_wt_ofst->i1_luma_log2_weight_denom) + value;
SEV_PARSE("luma_offset_l1[ i ]", value, ps_bitstrm);
+ if( value < -128 || value > 127 )
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_wt_ofst->i2_luma_offset_l1[i] = value;
}
@@ -289,20 +331,36 @@ WORD32 ihevcd_parse_pred_wt_ofst(bitstrm_t *ps_bitstrm,
WORD32 ofst;
WORD32 shift = (1 << (BIT_DEPTH_CHROMA - 1));
SEV_PARSE("delta_chroma_weight_l1[ i ][ j ]", value, ps_bitstrm);
+ if(value < -128 || value > 127)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_wt_ofst->i2_chroma_weight_l1_cb[i] = (1 << ps_wt_ofst->i1_chroma_log2_weight_denom) + value;;
SEV_PARSE("delta_chroma_offset_l1[ i ][ j ]", value, ps_bitstrm);
+ if( value < -512 || value > 511 )
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ofst = ((shift * ps_wt_ofst->i2_chroma_weight_l1_cb[i]) >> ps_wt_ofst->i1_chroma_log2_weight_denom);
ofst = value - ofst + shift;
ps_wt_ofst->i2_chroma_offset_l1_cb[i] = CLIP_S8(ofst);;
SEV_PARSE("delta_chroma_weight_l1[ i ][ j ]", value, ps_bitstrm);
+ if(value < -128 || value > 127)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_wt_ofst->i2_chroma_weight_l1_cr[i] = (1 << ps_wt_ofst->i1_chroma_log2_weight_denom) + value;
SEV_PARSE("delta_chroma_offset_l1[ i ][ j ]", value, ps_bitstrm);
+ if( value < -512 || value > 511 )
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ofst = ((shift * ps_wt_ofst->i2_chroma_weight_l1_cr[i]) >> ps_wt_ofst->i1_chroma_log2_weight_denom);
ofst = value - ofst + shift;
@@ -358,7 +416,7 @@ IHEVCD_ERROR_T ihevcd_short_term_ref_pic_set(bitstrm_t *ps_bitstrm,
stref_picset_t *ps_stref_picset)
{
IHEVCD_ERROR_T ret = (IHEVCD_ERROR_T)IHEVCD_SUCCESS;
- WORD32 value;
+ UWORD32 value;
stref_picset_t *ps_stref_picset_ref;
WORD32 delta_idx, delta_rps;
WORD32 r_idx;
@@ -383,6 +441,10 @@ IHEVCD_ERROR_T ihevcd_short_term_ref_pic_set(bitstrm_t *ps_bitstrm,
if(idx == num_short_term_ref_pic_sets)
{
UEV_PARSE("delta_idx_minus1", value, ps_bitstrm);
+ if(value > num_short_term_ref_pic_sets - 1)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
delta_idx = value + 1;
}
else
@@ -398,6 +460,10 @@ IHEVCD_ERROR_T ihevcd_short_term_ref_pic_set(bitstrm_t *ps_bitstrm,
delta_rps_sign = value;
UEV_PARSE("abs_delta_rps_minus1", value, ps_bitstrm);
+ if(value > 32767)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
abs_delta_rps = value + 1;
delta_rps = (1 - 2 * delta_rps_sign) * (abs_delta_rps);
@@ -492,16 +558,18 @@ IHEVCD_ERROR_T ihevcd_short_term_ref_pic_set(bitstrm_t *ps_bitstrm,
WORD32 poc;
UEV_PARSE("num_negative_pics", value, ps_bitstrm);
+ if(value > MAX_DPB_SIZE - 1)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_stref_picset->i1_num_neg_pics = value;
- ps_stref_picset->i1_num_neg_pics = CLIP3(ps_stref_picset->i1_num_neg_pics,
- 0,
- MAX_DPB_SIZE - 1);
UEV_PARSE("num_positive_pics", value, ps_bitstrm);
+ if(value > (MAX_DPB_SIZE - 1 - ps_stref_picset->i1_num_neg_pics))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_stref_picset->i1_num_pos_pics = value;
- ps_stref_picset->i1_num_pos_pics = CLIP3(ps_stref_picset->i1_num_pos_pics,
- 0,
- (MAX_DPB_SIZE - 1 - ps_stref_picset->i1_num_neg_pics));
ps_stref_picset->i1_num_delta_pocs =
ps_stref_picset->i1_num_neg_pics +
@@ -511,7 +579,11 @@ IHEVCD_ERROR_T ihevcd_short_term_ref_pic_set(bitstrm_t *ps_bitstrm,
for(i = 0; i < ps_stref_picset->i1_num_neg_pics; i++)
{
UEV_PARSE("delta_poc_s0_minus1", value, ps_bitstrm);
- poc = prev_poc - (value + 1);
+ if(value > 32767)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+ poc = prev_poc - ((WORD32)(value + 1));
prev_poc = poc;
ps_stref_picset->ai2_delta_poc[i] = poc;
@@ -525,6 +597,10 @@ IHEVCD_ERROR_T ihevcd_short_term_ref_pic_set(bitstrm_t *ps_bitstrm,
i++)
{
UEV_PARSE("delta_poc_s1_minus1", value, ps_bitstrm);
+ if(value > 32767)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
poc = prev_poc + (value + 1);
prev_poc = poc;
ps_stref_picset->ai2_delta_poc[i] = poc;
@@ -551,12 +627,27 @@ static WORD32 ihevcd_parse_sub_layer_hrd_parameters(bitstrm_t *ps_bitstrm,
for(i = 0; i <= cpb_cnt; i++)
{
UEV_PARSE("bit_rate_value_minus1[ i ]", ps_sub_layer_hrd_params->au4_bit_rate_value_minus1[i], ps_bitstrm);
+ if(ps_sub_layer_hrd_params->au4_bit_rate_value_minus1[i] > UINT_MAX - 1)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
UEV_PARSE("cpb_size_value_minus1[ i ]", ps_sub_layer_hrd_params->au4_cpb_size_value_minus1[i], ps_bitstrm);
-
+ if(ps_sub_layer_hrd_params->au4_cpb_size_value_minus1[i] > UINT_MAX - 1)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
if(sub_pic_cpb_params_present_flag)
{
UEV_PARSE("cpb_size_du_value_minus1[ i ]", ps_sub_layer_hrd_params->au4_cpb_size_du_value_minus1[i], ps_bitstrm);
+ if(ps_sub_layer_hrd_params->au4_cpb_size_du_value_minus1[i] > UINT_MAX - 1)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
UEV_PARSE("bit_rate_du_value_minus1[ i ]", ps_sub_layer_hrd_params->au4_bit_rate_du_value_minus1[i], ps_bitstrm);
+ if(ps_sub_layer_hrd_params->au4_bit_rate_du_value_minus1[i] > UINT_MAX - 1)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
}
BITS_PARSE("cbr_flag[ i ]", ps_sub_layer_hrd_params->au1_cbr_flag[i], ps_bitstrm, 1);
}
@@ -624,7 +715,7 @@ static WORD32 ihevcd_parse_hrd_parameters(bitstrm_t *ps_bitstrm,
BITS_PARSE("fixed_pic_rate_general_flag[ i ]", ps_hrd->au1_fixed_pic_rate_general_flag[i], ps_bitstrm, 1);
ps_hrd->au1_fixed_pic_rate_within_cvs_flag[i] = 1;
- ps_hrd->au1_elemental_duration_in_tc_minus1[i] = 0;
+ ps_hrd->au2_elemental_duration_in_tc_minus1[i] = 0;
ps_hrd->au1_low_delay_hrd_flag[i] = 0;
ps_hrd->au1_cpb_cnt_minus1[i] = 0;
@@ -633,7 +724,11 @@ static WORD32 ihevcd_parse_hrd_parameters(bitstrm_t *ps_bitstrm,
if(ps_hrd->au1_fixed_pic_rate_within_cvs_flag[i])
{
- UEV_PARSE("elemental_duration_in_tc_minus1[ i ]", ps_hrd->au1_elemental_duration_in_tc_minus1[i], ps_bitstrm);
+ UEV_PARSE("elemental_duration_in_tc_minus1[ i ]", ps_hrd->au2_elemental_duration_in_tc_minus1[i], ps_bitstrm);
+ if(ps_hrd->au2_elemental_duration_in_tc_minus1[i] > 2047)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
}
else
{
@@ -641,10 +736,13 @@ static WORD32 ihevcd_parse_hrd_parameters(bitstrm_t *ps_bitstrm,
}
if(!ps_hrd->au1_low_delay_hrd_flag[i])
+ {
UEV_PARSE("cpb_cnt_minus1[ i ]", ps_hrd->au1_cpb_cnt_minus1[i], ps_bitstrm);
-
- if(ps_hrd->au1_cpb_cnt_minus1[i] >= (MAX_CPB_CNT - 1))
- return IHEVCD_INVALID_PARAMETER;
+ if(ps_hrd->au1_cpb_cnt_minus1[i] > (MAX_CPB_CNT - 1))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+ }
if(ps_hrd->u1_nal_hrd_parameters_present_flag)
ihevcd_parse_sub_layer_hrd_parameters(ps_bitstrm,
@@ -791,7 +889,15 @@ static WORD32 ihevcd_parse_vui_parameters(bitstrm_t *ps_bitstrm,
if(ps_vui->u1_chroma_loc_info_present_flag)
{
UEV_PARSE("chroma_sample_loc_type_top_field", ps_vui->u1_chroma_sample_loc_type_top_field, ps_bitstrm);
+ if(ps_vui->u1_chroma_sample_loc_type_top_field > CHROMA_FMT_IDC_YUV444_PLANES + 1)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
UEV_PARSE("chroma_sample_loc_type_bottom_field", ps_vui->u1_chroma_sample_loc_type_bottom_field, ps_bitstrm);
+ if(ps_vui->u1_chroma_sample_loc_type_bottom_field > CHROMA_FMT_IDC_YUV444_PLANES + 1)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
}
BITS_PARSE("neutral_chroma_indication_flag", ps_vui->u1_neutral_chroma_indication_flag, ps_bitstrm, 1);
@@ -817,8 +923,13 @@ static WORD32 ihevcd_parse_vui_parameters(bitstrm_t *ps_bitstrm,
BITS_PARSE("vui_time_scale", ps_vui->u4_vui_time_scale, ps_bitstrm, 32);
BITS_PARSE("vui_poc_proportional_to_timing_flag", ps_vui->u1_poc_proportional_to_timing_flag, ps_bitstrm, 1);
if(ps_vui->u1_poc_proportional_to_timing_flag)
- UEV_PARSE("vui_num_ticks_poc_diff_one_minus1", ps_vui->u1_num_ticks_poc_diff_one_minus1, ps_bitstrm);
-
+ {
+ UEV_PARSE("vui_num_ticks_poc_diff_one_minus1", ps_vui->u4_num_ticks_poc_diff_one_minus1, ps_bitstrm);
+ if(ps_vui->u4_num_ticks_poc_diff_one_minus1 > UINT_MAX - 1)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+ }
BITS_PARSE("vui_hrd_parameters_present_flag", ps_vui->u1_vui_hrd_parameters_present_flag, ps_bitstrm, 1);
if(ps_vui->u1_vui_hrd_parameters_present_flag)
{
@@ -843,10 +954,30 @@ static WORD32 ihevcd_parse_vui_parameters(bitstrm_t *ps_bitstrm,
BITS_PARSE("restricted_ref_pic_lists_flag", ps_vui->u1_restricted_ref_pic_lists_flag, ps_bitstrm, 1);
UEV_PARSE("min_spatial_segmentation_idc", ps_vui->u4_min_spatial_segmentation_idc, ps_bitstrm);
+ if(ps_vui->u4_min_spatial_segmentation_idc > 4095)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
UEV_PARSE("max_bytes_per_pic_denom", ps_vui->u1_max_bytes_per_pic_denom, ps_bitstrm);
+ if(ps_vui->u1_max_bytes_per_pic_denom > 16)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
UEV_PARSE("max_bits_per_min_cu_denom", ps_vui->u1_max_bits_per_mincu_denom, ps_bitstrm);
+ if(ps_vui->u1_max_bits_per_mincu_denom > 16)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
UEV_PARSE("log2_max_mv_length_horizontal", ps_vui->u1_log2_max_mv_length_horizontal, ps_bitstrm);
+ if(ps_vui->u1_max_bits_per_mincu_denom > 16)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
UEV_PARSE("log2_max_mv_length_vertical", ps_vui->u1_log2_max_mv_length_vertical, ps_bitstrm);
+ if(ps_vui->u1_max_bits_per_mincu_denom > 15)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
}
return ret;
@@ -1036,6 +1167,7 @@ IHEVCD_ERROR_T ihevcd_scaling_list_data(codec_t *ps_codec, WORD16 *pi2_scaling_
WORD32 size_id;
WORD32 matrix_id;
WORD32 value, dc_value = 0;
+ UWORD32 u4_value;
WORD32 next_coef;
WORD32 coef_num;
WORD32 i, j, offset;
@@ -1058,13 +1190,16 @@ IHEVCD_ERROR_T ihevcd_scaling_list_data(codec_t *ps_codec, WORD16 *pi2_scaling_
if(!scaling_list_pred_mode_flag)
{
WORD32 num_elements;
- UEV_PARSE("scaling_list_pred_matrix_id_delta", value,
+ UEV_PARSE("scaling_list_pred_matrix_id_delta", u4_value,
ps_bitstrm);
- value = CLIP3(value, 0, matrix_id);
+ if(u4_value > matrix_id)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
num_elements = (1 << (4 + (size_id << 1)));
- if(0 != value)
- memcpy(pi2_scaling_mat_offset, pi2_scaling_mat_offset - value * num_elements, num_elements * sizeof(WORD16));
+ if(0 != u4_value)
+ memmove(pi2_scaling_mat_offset, pi2_scaling_mat_offset - u4_value * num_elements, num_elements * sizeof(WORD16));
}
else
{
@@ -1075,7 +1210,10 @@ IHEVCD_ERROR_T ihevcd_scaling_list_data(codec_t *ps_codec, WORD16 *pi2_scaling_
{
SEV_PARSE("scaling_list_dc_coef_minus8", value,
ps_bitstrm);
-
+ if(value < -7 || value > 247)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
next_coef = value + 8;
dc_value = next_coef;
}
@@ -1087,6 +1225,10 @@ IHEVCD_ERROR_T ihevcd_scaling_list_data(codec_t *ps_codec, WORD16 *pi2_scaling_
{
SEV_PARSE("scaling_list_delta_coef",
scaling_list_delta_coef, ps_bitstrm);
+ if((scaling_list_delta_coef < -256) || (scaling_list_delta_coef > 255))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
next_coef = (next_coef + scaling_list_delta_coef + 256)
% 256;
pi2_scaling_mat_offset[scan_table[i]] = next_coef;
@@ -1100,6 +1242,10 @@ IHEVCD_ERROR_T ihevcd_scaling_list_data(codec_t *ps_codec, WORD16 *pi2_scaling_
{
SEV_PARSE("scaling_list_delta_coef",
scaling_list_delta_coef, ps_bitstrm);
+ if((scaling_list_delta_coef < -256) || (scaling_list_delta_coef > 255))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
next_coef = (next_coef + scaling_list_delta_coef + 256)
% 256;
@@ -1120,6 +1266,10 @@ IHEVCD_ERROR_T ihevcd_scaling_list_data(codec_t *ps_codec, WORD16 *pi2_scaling_
{
SEV_PARSE("scaling_list_delta_coef",
scaling_list_delta_coef, ps_bitstrm);
+ if((scaling_list_delta_coef < -256) || (scaling_list_delta_coef > 255))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
next_coef = (next_coef + scaling_list_delta_coef + 256)
% 256;
@@ -1169,7 +1319,7 @@ IHEVCD_ERROR_T ihevcd_parse_vps(codec_t *ps_codec)
{
IHEVCD_ERROR_T ret = (IHEVCD_ERROR_T)IHEVCD_SUCCESS;
WORD32 i;
- WORD32 value;
+ UWORD32 value;
WORD32 vps_id;
vps_t *ps_vps;
bitstrm_t *ps_bitstrm = &ps_codec->s_parse.s_bitstrm;
@@ -1196,6 +1346,10 @@ IHEVCD_ERROR_T ihevcd_parse_vps(codec_t *ps_codec)
BITS_PARSE("vps_max_sub_layers_minus1", value, ps_bitstrm, 3);
+ if(value > SPS_MAX_SUB_LAYERS - 1)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_vps->i1_vps_max_sub_layers = value + 1;
ASSERT(ps_vps->i1_vps_max_sub_layers < VPS_MAX_SUB_LAYERS);
@@ -1216,13 +1370,25 @@ IHEVCD_ERROR_T ihevcd_parse_vps(codec_t *ps_codec)
for(; i < ps_vps->i1_vps_max_sub_layers; i++)
{
UEV_PARSE("vps_max_dec_pic_buffering[i]", value, ps_bitstrm);
+ if(value > MAX_DPB_SIZE)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_vps->ai1_vps_max_dec_pic_buffering[i] = value;
/* vps_num_reorder_pics (no max) used in print in order to match with HM */
UEV_PARSE("vps_num_reorder_pics[i]", value, ps_bitstrm);
+ if(value >= ps_vps->ai1_vps_max_dec_pic_buffering[i])
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_vps->ai1_vps_max_num_reorder_pics[i] = value;
UEV_PARSE("vps_max_latency_increase[i]", value, ps_bitstrm);
+ if(value > UINT_MAX - 2)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_vps->ai1_vps_max_latency_increase[i] = value;
}
@@ -1232,6 +1398,10 @@ IHEVCD_ERROR_T ihevcd_parse_vps(codec_t *ps_codec)
//ps_vps->i1_vps_max_layer_id = value;
UEV_PARSE("vps_num_layer_sets_minus1", value, ps_bitstrm);
+ if(value > 1023)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
//ps_vps->i1_vps_num_layer_sets = value + 1;
BITS_PARSE("vps_timing_info_present_flag", value, ps_bitstrm, 1);
@@ -1267,7 +1437,7 @@ IHEVCD_ERROR_T ihevcd_parse_vps(codec_t *ps_codec)
IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
{
IHEVCD_ERROR_T ret = (IHEVCD_ERROR_T)IHEVCD_SUCCESS;
- WORD32 value;
+ UWORD32 value;
WORD32 i;
WORD32 vps_id;
@@ -1281,12 +1451,18 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
BITS_PARSE("video_parameter_set_id", value, ps_bitstrm, 4);
+ if(value > MAX_VPS_CNT - 1)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
vps_id = value;
- vps_id = CLIP3(vps_id, 0, MAX_VPS_CNT - 1);
BITS_PARSE("sps_max_sub_layers_minus1", value, ps_bitstrm, 3);
+ if(value > SPS_MAX_SUB_LAYERS - 1)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
sps_max_sub_layers = value + 1;
- sps_max_sub_layers = CLIP3(sps_max_sub_layers, 1, 7);
BITS_PARSE("sps_temporal_id_nesting_flag", value, ps_bitstrm, 1);
sps_temporal_id_nesting_flag = value;
@@ -1297,7 +1473,6 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
UEV_PARSE("seq_parameter_set_id", value, ps_bitstrm);
sps_id = value;
-
if((sps_id >= MAX_SPS_CNT) || (sps_id < 0))
{
if(ps_codec->i4_sps_done)
@@ -1322,6 +1497,10 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
memcpy(&ps_sps->s_ptl, &s_ptl, sizeof(profile_tier_lvl_info_t));
UEV_PARSE("chroma_format_idc", value, ps_bitstrm);
+ if(value > 3)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_sps->i1_chroma_format_idc = value;
if(ps_sps->i1_chroma_format_idc != CHROMA_FMT_IDC_YUV420)
@@ -1341,9 +1520,17 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
}
UEV_PARSE("pic_width_in_luma_samples", value, ps_bitstrm);
+ if(value > INT16_MAX)
+ {
+ return (IHEVCD_ERROR_T)IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED;
+ }
ps_sps->i2_pic_width_in_luma_samples = value;
UEV_PARSE("pic_height_in_luma_samples", value, ps_bitstrm);
+ if(value > INT16_MAX)
+ {
+ return (IHEVCD_ERROR_T)IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED;
+ }
ps_sps->i2_pic_height_in_luma_samples = value;
if((0 >= ps_sps->i2_pic_width_in_luma_samples) || (0 >= ps_sps->i2_pic_height_in_luma_samples))
@@ -1356,28 +1543,28 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
{
UEV_PARSE("pic_crop_left_offset", value, ps_bitstrm);
- if (value < 0 || value >= ps_sps->i2_pic_width_in_luma_samples)
+ if (value >= ps_sps->i2_pic_width_in_luma_samples)
{
return IHEVCD_INVALID_PARAMETER;
}
ps_sps->i2_pic_crop_left_offset = value;
UEV_PARSE("pic_crop_right_offset", value, ps_bitstrm);
- if (value < 0 || value >= ps_sps->i2_pic_width_in_luma_samples)
+ if (value >= ps_sps->i2_pic_width_in_luma_samples)
{
return IHEVCD_INVALID_PARAMETER;
}
ps_sps->i2_pic_crop_right_offset = value;
UEV_PARSE("pic_crop_top_offset", value, ps_bitstrm);
- if (value < 0 || value >= ps_sps->i2_pic_height_in_luma_samples)
+ if (value >= ps_sps->i2_pic_height_in_luma_samples)
{
return IHEVCD_INVALID_PARAMETER;
}
ps_sps->i2_pic_crop_top_offset = value;
UEV_PARSE("pic_crop_bottom_offset", value, ps_bitstrm);
- if (value < 0 || value >= ps_sps->i2_pic_height_in_luma_samples)
+ if (value >= ps_sps->i2_pic_height_in_luma_samples)
{
return IHEVCD_INVALID_PARAMETER;
}
@@ -1401,11 +1588,12 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
return IHEVCD_UNSUPPORTED_BIT_DEPTH;
UEV_PARSE("log2_max_pic_order_cnt_lsb_minus4", value, ps_bitstrm);
- if(value < 0 || value > 12)
+ if(value > 12)
return IHEVCD_INVALID_PARAMETER;
ps_sps->i1_log2_max_pic_order_cnt_lsb = value + 4;
BITS_PARSE("sps_sub_layer_ordering_info_present_flag", value, ps_bitstrm, 1);
+
ps_sps->i1_sps_sub_layer_ordering_info_present_flag = value;
@@ -1413,20 +1601,24 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
for(; i < ps_sps->i1_sps_max_sub_layers; i++)
{
UEV_PARSE("max_dec_pic_buffering", value, ps_bitstrm);
- if(value < 0 || (value + 1) > MAX_DPB_SIZE)
+ if(value > (MAX_DPB_SIZE - 1))
{
return IHEVCD_INVALID_PARAMETER;
}
ps_sps->ai1_sps_max_dec_pic_buffering[i] = value + 1;
UEV_PARSE("num_reorder_pics", value, ps_bitstrm);
- if(value < 0 || value > ps_sps->ai1_sps_max_dec_pic_buffering[i])
+ if(value >= ps_sps->ai1_sps_max_dec_pic_buffering[i])
{
return IHEVCD_INVALID_PARAMETER;
}
ps_sps->ai1_sps_max_num_reorder_pics[i] = value;
UEV_PARSE("max_latency_increase", value, ps_bitstrm);
+ if(value > UINT_MAX - 2)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_sps->ai1_sps_max_latency_increase[i] = value;
}
@@ -1464,15 +1656,25 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
return IHEVCD_INVALID_PARAMETER;
}
ps_sps->i1_log2_min_coding_block_size = value + 3;
+ if((ps_sps->i2_pic_width_in_luma_samples % (1 << ps_sps->i1_log2_min_coding_block_size) != 0) ||
+ (ps_sps->i2_pic_height_in_luma_samples % (1 << ps_sps->i1_log2_min_coding_block_size) != 0))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
UEV_PARSE("log2_diff_max_min_coding_block_size", value, ps_bitstrm);
- if(value > (LOG2_MAX_CU_SIZE - LOG2_MIN_CU_SIZE))
+ if(value > (LOG2_MAX_CU_SIZE - ps_sps->i1_log2_min_coding_block_size))
{
return IHEVCD_INVALID_PARAMETER;
}
ps_sps->i1_log2_diff_max_min_coding_block_size = value;
ctb_log2_size_y = ps_sps->i1_log2_min_coding_block_size + ps_sps->i1_log2_diff_max_min_coding_block_size;
+
+ if((ctb_log2_size_y < LOG2_MIN_CTB_SIZE) || (ctb_log2_size_y > LOG2_MAX_CTB_SIZE))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
/* Check if CTB size is different in case of multiple SPS with same ID */
{
sps_t *ps_sps_old = (ps_codec->s_parse.ps_sps_base + sps_id);
@@ -1486,6 +1688,8 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
return (IHEVCD_ERROR_T)IVD_RES_CHANGED;
}
}
+ ps_sps->i1_log2_ctb_size = ctb_log2_size_y;
+
UEV_PARSE("log2_min_transform_block_size_minus2", value, ps_bitstrm);
if(value > (LOG2_MAX_TU_SIZE - 2))
{
@@ -1498,7 +1702,7 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
}
UEV_PARSE("log2_diff_max_min_transform_block_size", value, ps_bitstrm);
- if(value > (LOG2_MAX_TU_SIZE - LOG2_MIN_TU_SIZE))
+ if(value > (LOG2_MAX_TU_SIZE - ps_sps->i1_log2_min_transform_block_size))
{
return IHEVCD_INVALID_PARAMETER;
}
@@ -1507,23 +1711,7 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
ps_sps->i1_log2_max_transform_block_size = ps_sps->i1_log2_min_transform_block_size +
ps_sps->i1_log2_diff_max_min_transform_block_size;
- if ((ps_sps->i1_log2_max_transform_block_size < 0) ||
- (ps_sps->i1_log2_max_transform_block_size > MIN(ctb_log2_size_y, 5)))
- {
- return IHEVCD_INVALID_PARAMETER;
- }
-
- ps_sps->i1_log2_ctb_size = ps_sps->i1_log2_min_coding_block_size +
- ps_sps->i1_log2_diff_max_min_coding_block_size;
-
- if((ps_sps->i1_log2_min_coding_block_size < 3) ||
- (ps_sps->i1_log2_min_transform_block_size < 2) ||
- (ps_sps->i1_log2_diff_max_min_transform_block_size < 0) ||
- (ps_sps->i1_log2_max_transform_block_size > ps_sps->i1_log2_ctb_size) ||
- (ps_sps->i1_log2_ctb_size < 4) ||
- (ps_sps->i1_log2_ctb_size > 6) ||
- (ps_sps->i2_pic_width_in_luma_samples % (1 << ps_sps->i1_log2_min_coding_block_size) != 0) ||
- (ps_sps->i2_pic_height_in_luma_samples % (1 << ps_sps->i1_log2_min_coding_block_size) != 0))
+ if(ps_sps->i1_log2_max_transform_block_size > ps_sps->i1_log2_ctb_size)
{
return IHEVCD_INVALID_PARAMETER;
}
@@ -1532,14 +1720,14 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
ps_sps->i1_log2_diff_max_min_pcm_coding_block_size = 0;
UEV_PARSE("max_transform_hierarchy_depth_inter", value, ps_bitstrm);
- if(value < 0 || value > (ps_sps->i1_log2_ctb_size - ps_sps->i1_log2_min_transform_block_size))
+ if(value > (ps_sps->i1_log2_ctb_size - ps_sps->i1_log2_min_transform_block_size))
{
return IHEVCD_INVALID_PARAMETER;
}
ps_sps->i1_max_transform_hierarchy_depth_inter = value;
UEV_PARSE("max_transform_hierarchy_depth_intra", value, ps_bitstrm);
- if(value < 0 || value > (ps_sps->i1_log2_ctb_size - ps_sps->i1_log2_min_transform_block_size))
+ if(value > (ps_sps->i1_log2_ctb_size - ps_sps->i1_log2_min_transform_block_size))
{
return IHEVCD_INVALID_PARAMETER;
}
@@ -1581,16 +1769,24 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
ps_sps->i1_pcm_sample_bit_depth_chroma = value + 1;
UEV_PARSE("log2_min_pcm_coding_block_size_minus3", value, ps_bitstrm);
+ if(value < (ps_sps->i1_log2_min_coding_block_size - 3) || value > (MIN(ctb_log2_size_y, 5) - 3))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_sps->i1_log2_min_pcm_coding_block_size = value + 3;
UEV_PARSE("log2_diff_max_min_pcm_coding_block_size", value, ps_bitstrm);
+ if(value > MIN(ctb_log2_size_y, 5) - ps_sps->i1_log2_min_pcm_coding_block_size)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_sps->i1_log2_diff_max_min_pcm_coding_block_size = value;
BITS_PARSE("pcm_loop_filter_disable_flag", value, ps_bitstrm, 1);
ps_sps->i1_pcm_loop_filter_disable_flag = value;
}
UEV_PARSE("num_short_term_ref_pic_sets", value, ps_bitstrm);
- if(value < 0 || value > MAX_STREF_PICS_SPS)
+ if(value > MAX_STREF_PICS_SPS)
{
return IHEVCD_INVALID_PARAMETER;
}
@@ -1611,7 +1807,7 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
if(ps_sps->i1_long_term_ref_pics_present_flag)
{
UEV_PARSE("num_long_term_ref_pics_sps", value, ps_bitstrm);
- if(value < 0 || value > MAX_LTREF_PICS_SPS)
+ if(value > MAX_LTREF_PICS_SPS)
{
return IHEVCD_INVALID_PARAMETER;
}
@@ -1845,7 +2041,8 @@ void ihevcd_copy_sps(codec_t *ps_codec, WORD32 sps_id, WORD32 sps_id_ref)
IHEVCD_ERROR_T ihevcd_parse_pps(codec_t *ps_codec)
{
IHEVCD_ERROR_T ret = (IHEVCD_ERROR_T)IHEVCD_SUCCESS;
- WORD32 value;
+ UWORD32 value;
+ WORD32 i4_value;
WORD32 pps_id;
pps_t *ps_pps;
@@ -1873,8 +2070,11 @@ IHEVCD_ERROR_T ihevcd_parse_pps(codec_t *ps_codec)
ps_pps->i1_pps_id = pps_id;
UEV_PARSE("seq_parameter_set_id", value, ps_bitstrm);
+ if(value > MAX_SPS_CNT - 2)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_pps->i1_sps_id = value;
- ps_pps->i1_sps_id = CLIP3(ps_pps->i1_sps_id, 0, MAX_SPS_CNT - 2);
ps_sps = (ps_codec->s_parse.ps_sps_base + ps_pps->i1_sps_id);
@@ -1909,13 +2109,25 @@ IHEVCD_ERROR_T ihevcd_parse_pps(codec_t *ps_codec)
ps_pps->i1_cabac_init_present_flag = value;
UEV_PARSE("num_ref_idx_l0_default_active_minus1", value, ps_bitstrm);
+ if(value > MAX_DPB_SIZE - 2)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_pps->i1_num_ref_idx_l0_default_active = value + 1;
UEV_PARSE("num_ref_idx_l1_default_active_minus1", value, ps_bitstrm);
+ if(value > MAX_DPB_SIZE - 2)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_pps->i1_num_ref_idx_l1_default_active = value + 1;
- SEV_PARSE("pic_init_qp_minus26", value, ps_bitstrm);
- ps_pps->i1_pic_init_qp = value + 26;
+ SEV_PARSE("pic_init_qp_minus26", i4_value, ps_bitstrm);
+ if(i4_value < -26 || i4_value > 25)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+ ps_pps->i1_pic_init_qp = i4_value + 26;
BITS_PARSE("constrained_intra_pred_flag", value, ps_bitstrm, 1);
ps_pps->i1_constrained_intra_pred_flag = value;
@@ -1929,6 +2141,10 @@ IHEVCD_ERROR_T ihevcd_parse_pps(codec_t *ps_codec)
if(ps_pps->i1_cu_qp_delta_enabled_flag)
{
UEV_PARSE("diff_cu_qp_delta_depth", value, ps_bitstrm);
+ if(value > ps_sps->i1_log2_diff_max_min_coding_block_size)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_pps->i1_diff_cu_qp_delta_depth = value;
}
else
@@ -1937,12 +2153,20 @@ IHEVCD_ERROR_T ihevcd_parse_pps(codec_t *ps_codec)
}
ps_pps->i1_log2_min_cu_qp_delta_size = ps_sps->i1_log2_ctb_size - ps_pps->i1_diff_cu_qp_delta_depth;
/* Print different */
- SEV_PARSE("cb_qp_offset", value, ps_bitstrm);
- ps_pps->i1_pic_cb_qp_offset = value;
+ SEV_PARSE("cb_qp_offset", i4_value, ps_bitstrm);
+ if(i4_value < -12 || i4_value > 12)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+ ps_pps->i1_pic_cb_qp_offset = i4_value;
/* Print different */
- SEV_PARSE("cr_qp_offset", value, ps_bitstrm);
- ps_pps->i1_pic_cr_qp_offset = value;
+ SEV_PARSE("cr_qp_offset", i4_value, ps_bitstrm);
+ if(i4_value < -12 || i4_value > 12)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+ ps_pps->i1_pic_cr_qp_offset = i4_value;
/* Print different */
BITS_PARSE("slicelevel_chroma_qp_flag", value, ps_bitstrm, 1);
@@ -2019,7 +2243,7 @@ IHEVCD_ERROR_T ihevcd_parse_pps(codec_t *ps_codec)
{
- WORD32 start;
+ UWORD32 start;
WORD32 i, j;
@@ -2058,7 +2282,7 @@ IHEVCD_ERROR_T ihevcd_parse_pps(codec_t *ps_codec)
start += value;
if((start > ps_sps->i2_pic_wd_in_ctb) ||
- (value <= 0))
+ (value == 0))
return IHEVCD_INVALID_HEADER;
}
@@ -2098,7 +2322,7 @@ IHEVCD_ERROR_T ihevcd_parse_pps(codec_t *ps_codec)
start += value;
if((start > ps_sps->i2_pic_ht_in_ctb) ||
- (value <= 0))
+ (value == 0))
return IHEVCD_INVALID_HEADER;
}
}
@@ -2146,11 +2370,19 @@ IHEVCD_ERROR_T ihevcd_parse_pps(codec_t *ps_codec)
if(!ps_pps->i1_pic_disable_deblocking_filter_flag)
{
- SEV_PARSE("pps_beta_offset_div2", value, ps_bitstrm);
- ps_pps->i1_beta_offset_div2 = value;
+ SEV_PARSE("pps_beta_offset_div2", i4_value, ps_bitstrm);
+ if(i4_value < -6 || i4_value > 6)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+ ps_pps->i1_beta_offset_div2 = i4_value;
- SEV_PARSE("pps_tc_offset_div2", value, ps_bitstrm);
- ps_pps->i1_tc_offset_div2 = value;
+ SEV_PARSE("pps_tc_offset_div2", i4_value, ps_bitstrm);
+ if(i4_value < -6 || i4_value > 6)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+ ps_pps->i1_tc_offset_div2 = i4_value;
}
}
@@ -2167,6 +2399,10 @@ IHEVCD_ERROR_T ihevcd_parse_pps(codec_t *ps_codec)
BITS_PARSE("lists_modification_present_flag", value, ps_bitstrm, 1);
ps_pps->i1_lists_modification_present_flag = value;
UEV_PARSE("log2_parallel_merge_level_minus2", value, ps_bitstrm);
+ if(value > (ps_sps->i1_log2_min_coding_block_size + ps_sps->i1_log2_diff_max_min_coding_block_size))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_pps->i1_log2_parallel_merge_level = value + 2;
BITS_PARSE("slice_header_extension_present_flag", value, ps_bitstrm, 1);
@@ -2235,6 +2471,10 @@ IHEVCD_ERROR_T ihevcd_parse_buffering_period_sei(codec_t *ps_codec,
ps_parse->s_sei_params.i1_buf_period_params_present_flag = 1;
UEV_PARSE("bp_seq_parameter_set_id", value, ps_bitstrm);
+ if(value > MAX_SPS_CNT - 2)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_buf_period_sei_params->u1_bp_seq_parameter_set_id = value;
if(!ps_vui_hdr->u1_sub_pic_cpb_params_present_flag)
@@ -2427,6 +2667,10 @@ IHEVCD_ERROR_T ihevcd_parse_pic_timing_sei(codec_t *ps_codec, sps_t *ps_sps)
UWORD32 array_size;
UEV_PARSE("num_decoding_units_minus1", value, ps_bitstrm);
+ if(value > (ps_sps->i4_pic_size_in_ctb -1))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_pic_timing->u4_num_decoding_units_minus1 = value;
num_units_minus1 = ps_pic_timing->u4_num_decoding_units_minus1;
@@ -2452,6 +2696,10 @@ IHEVCD_ERROR_T ihevcd_parse_pic_timing_sei(codec_t *ps_codec, sps_t *ps_sps)
for(i = 0; i <= ps_pic_timing->u4_num_decoding_units_minus1; i++)
{
UEV_PARSE("num_nalus_in_du_minus1", value, ps_bitstrm);
+ if(value > (ps_sps->i4_pic_size_in_ctb -1))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_pic_timing->au4_num_nalus_in_du_minus1[i] = value;
if((!ps_pic_timing->u1_du_common_cpb_removal_delay_flag)
diff --git a/decoder/ihevcd_parse_residual.c b/decoder/ihevcd_parse_residual.c
index 6e2a39c..0a39f99 100644
--- a/decoder/ihevcd_parse_residual.c
+++ b/decoder/ihevcd_parse_residual.c
@@ -721,7 +721,7 @@ WORD32 ihevcd_parse_residual_coding(codec_t *ps_codec,
/* If there are zero coeffs, then shift by as many zero coeffs and decrement n */
clz = CLZ(u4_sig_coeff_map_shift);
u4_sig_coeff_map_shift <<= clz;
- n -= clz;
+ n -= (WORD32)clz;
}while(u4_sig_coeff_map_shift);
}
/* At this level u4_sig_coeff_map is non-zero i.e. has atleast one non-zero coeff */
@@ -883,7 +883,7 @@ WORD32 ihevcd_parse_residual_coding(codec_t *ps_codec,
/* If there are zero coeffs, then shift by as many zero coeffs and decrement n */
clz = CLZ(u4_sig_coeff_map_shift);
u4_sig_coeff_map_shift <<= clz;
- n -= clz;
+ n -= (WORD32)clz;
}while(u4_sig_coeff_map_shift);
diff --git a/decoder/ihevcd_parse_slice.c b/decoder/ihevcd_parse_slice.c
index aedfbe7..a3e1e69 100644
--- a/decoder/ihevcd_parse_slice.c
+++ b/decoder/ihevcd_parse_slice.c
@@ -3168,13 +3168,17 @@ IHEVCD_ERROR_T ihevcd_parse_slice_data(codec_t *ps_codec)
WORD32 ctb_row, ctb_col, index_pic_map, index_nbr_map;
WORD32 first_pu_of_ctb;
first_pu_of_ctb = pu4_nbr_pu_idx[1 + nbr_pu_idx_strd];
+ UWORD32 cur_ctb_ht_in_min_pu = MIN(((ps_sps->i2_pic_height_in_luma_samples
+ - (ps_codec->s_parse.i4_ctb_y << ps_sps->i1_log2_ctb_size)) / MIN_PU_SIZE), ctb_size_in_min_pu);
+ UWORD32 cur_ctb_wd_in_min_pu = MIN(((ps_sps->i2_pic_width_in_luma_samples
+ - (ps_codec->s_parse.i4_ctb_x << ps_sps->i1_log2_ctb_size)) / MIN_PU_SIZE), ctb_size_in_min_pu);
index_pic_map = 0 * ctb_size_in_min_pu + 0;
index_nbr_map = (0 + 1) * nbr_pu_idx_strd + (0 + 1);
- for(ctb_row = 0; ctb_row < ctb_size_in_min_pu; ctb_row++)
+ for(ctb_row = 0; ctb_row < cur_ctb_ht_in_min_pu; ctb_row++)
{
- for(ctb_col = 0; ctb_col < ctb_size_in_min_pu; ctb_col++)
+ for(ctb_col = 0; ctb_col < cur_ctb_wd_in_min_pu; ctb_col++)
{
pu1_pic_pu_map_ctb[index_pic_map + ctb_col] = pu4_nbr_pu_idx[index_nbr_map + ctb_col]
- first_pu_of_ctb;
diff --git a/decoder/ihevcd_parse_slice_header.c b/decoder/ihevcd_parse_slice_header.c
index f08aa64..c161fc4 100644
--- a/decoder/ihevcd_parse_slice_header.c
+++ b/decoder/ihevcd_parse_slice_header.c
@@ -218,7 +218,8 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec,
nal_header_t *ps_nal)
{
IHEVCD_ERROR_T ret = (IHEVCD_ERROR_T)IHEVCD_SUCCESS;
- WORD32 value;
+ UWORD32 value;
+ WORD32 i4_value;
WORD32 i, j;
WORD32 sps_id;
@@ -233,7 +234,7 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec,
WORD32 no_output_of_prior_pics_flag = 0;
WORD8 i1_nal_unit_type = ps_nal->i1_nal_unit_type;
WORD32 num_poc_total_curr = 0;
- WORD32 slice_address;
+ UWORD32 slice_address;
WORD32 prev_slice_incomplete_flag = 0;
if(ps_codec->i4_slice_error == 1)
@@ -250,7 +251,10 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec,
BITS_PARSE("no_output_of_prior_pics_flag", no_output_of_prior_pics_flag, ps_bitstrm, 1);
}
UEV_PARSE("pic_parameter_set_id", pps_id, ps_bitstrm);
- pps_id = CLIP3(pps_id, 0, MAX_PPS_CNT - 2);
+ if(pps_id < 0 || pps_id > MAX_PPS_CNT - 2)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
/* Get the current PPS structure */
ps_pps = ps_codec->s_parse.ps_pps_base + pps_id;
@@ -357,7 +361,7 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec,
slice_address = value;
/* If slice address is greater than the number of CTBs in a picture,
* ignore the slice */
- if(value >= ps_sps->i4_pic_size_in_ctb || value <= 0)
+ if(value >= ps_sps->i4_pic_size_in_ctb || value == 0)
return IHEVCD_IGNORE_SLICE;
}
else
@@ -378,6 +382,10 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec,
//slice_reserved_undetermined_flag[ i ]
}
UEV_PARSE("slice_type", value, ps_bitstrm);
+ if(value > 2)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_slice_hdr->i1_slice_type = value;
/* If the picture is IRAP, slice type must be equal to ISLICE */
@@ -456,16 +464,18 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec,
if(ps_sps->i1_num_long_term_ref_pics_sps > 0)
{
UEV_PARSE("num_long_term_sps", value, ps_bitstrm);
+ if(value > ps_sps->i1_num_long_term_ref_pics_sps)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_slice_hdr->i1_num_long_term_sps = value;
-
- ps_slice_hdr->i1_num_long_term_sps = CLIP3(ps_slice_hdr->i1_num_long_term_sps,
- 0, MAX_DPB_SIZE - num_neg_pics - num_pos_pics);
}
UEV_PARSE("num_long_term_pics", value, ps_bitstrm);
+ if((value + ps_slice_hdr->i1_num_long_term_sps + num_neg_pics + num_pos_pics) > (MAX_DPB_SIZE - 1))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_slice_hdr->i1_num_long_term_pics = value;
- ps_slice_hdr->i1_num_long_term_pics = CLIP3(ps_slice_hdr->i1_num_long_term_pics,
- 0, MAX_DPB_SIZE - num_neg_pics - num_pos_pics -
- ps_slice_hdr->i1_num_long_term_sps);
for(i = 0; i < (ps_slice_hdr->i1_num_long_term_sps +
ps_slice_hdr->i1_num_long_term_pics); i++)
@@ -566,11 +576,19 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec,
if(ps_slice_hdr->i1_num_ref_idx_active_override_flag)
{
UEV_PARSE("num_ref_idx_l0_active_minus1", value, ps_bitstrm);
+ if(value > MAX_DPB_SIZE - 2)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_slice_hdr->i1_num_ref_idx_l0_active = value + 1;
if(BSLICE == ps_slice_hdr->i1_slice_type)
{
UEV_PARSE("num_ref_idx_l1_active_minus1", value, ps_bitstrm);
+ if(value > MAX_DPB_SIZE - 2)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_slice_hdr->i1_num_ref_idx_l1_active = value + 1;
}
@@ -578,16 +596,12 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec,
else
{
ps_slice_hdr->i1_num_ref_idx_l0_active = ps_pps->i1_num_ref_idx_l0_default_active;
-
if(BSLICE == ps_slice_hdr->i1_slice_type)
{
ps_slice_hdr->i1_num_ref_idx_l1_active = ps_pps->i1_num_ref_idx_l1_default_active;
}
}
- ps_slice_hdr->i1_num_ref_idx_l0_active = CLIP3(ps_slice_hdr->i1_num_ref_idx_l0_active, 0, MAX_DPB_SIZE - 1);
- ps_slice_hdr->i1_num_ref_idx_l1_active = CLIP3(ps_slice_hdr->i1_num_ref_idx_l1_active, 0, MAX_DPB_SIZE - 1);
-
if(0 == num_poc_total_curr)
return IHEVCD_IGNORE_SLICE;
if((ps_pps->i1_lists_modification_present_flag) && (num_poc_total_curr > 1))
@@ -628,11 +642,25 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec,
(!ps_slice_hdr->i1_collocated_from_l0_flag && (ps_slice_hdr->i1_num_ref_idx_l1_active > 1)))
{
UEV_PARSE("collocated_ref_idx", value, ps_bitstrm);
+ if((PSLICE == ps_slice_hdr->i1_slice_type || BSLICE == ps_slice_hdr->i1_slice_type) &&
+ ps_slice_hdr->i1_collocated_from_l0_flag)
+ {
+ if(value >= ps_slice_hdr->i1_num_ref_idx_l0_active)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+ }
+ if(BSLICE == ps_slice_hdr->i1_slice_type && !ps_slice_hdr->i1_collocated_from_l0_flag)
+ {
+ if(value >= ps_slice_hdr->i1_num_ref_idx_l1_active)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+ }
ps_slice_hdr->i1_collocated_ref_idx = value;
}
}
- ps_slice_hdr->i1_collocated_ref_idx = CLIP3(ps_slice_hdr->i1_collocated_ref_idx, 0, MAX_DPB_SIZE - 1);
if((ps_pps->i1_weighted_pred_flag && (PSLICE == ps_slice_hdr->i1_slice_type)) ||
(ps_pps->i1_weighted_bipred_flag && (BSLICE == ps_slice_hdr->i1_slice_type)))
@@ -640,20 +668,35 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec,
ihevcd_parse_pred_wt_ofst(ps_bitstrm, ps_sps, ps_pps, ps_slice_hdr);
}
UEV_PARSE("five_minus_max_num_merge_cand", value, ps_bitstrm);
+ if(value > 4)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_slice_hdr->i1_max_num_merge_cand = 5 - value;
}
- ps_slice_hdr->i1_max_num_merge_cand = CLIP3(ps_slice_hdr->i1_max_num_merge_cand, 1, 5);
- SEV_PARSE("slice_qp_delta", value, ps_bitstrm);
- ps_slice_hdr->i1_slice_qp_delta = value;
+ SEV_PARSE("slice_qp_delta", i4_value, ps_bitstrm);
+ if((i4_value + ps_pps->i1_pic_init_qp) < 0 || (i4_value + ps_pps->i1_pic_init_qp) > MAX_HEVC_QP)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+ ps_slice_hdr->i1_slice_qp_delta = i4_value;
if(ps_pps->i1_pic_slice_level_chroma_qp_offsets_present_flag)
{
- SEV_PARSE("slice_cb_qp_offset", value, ps_bitstrm);
- ps_slice_hdr->i1_slice_cb_qp_offset = value;
+ SEV_PARSE("slice_cb_qp_offset", i4_value, ps_bitstrm);
+ if(i4_value < -12 || i4_value > 12)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+ ps_slice_hdr->i1_slice_cb_qp_offset = i4_value;
- SEV_PARSE("slice_cr_qp_offset", value, ps_bitstrm);
- ps_slice_hdr->i1_slice_cr_qp_offset = value;
+ SEV_PARSE("slice_cr_qp_offset", i4_value, ps_bitstrm);
+ if(i4_value < -12 || i4_value > 12)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+ ps_slice_hdr->i1_slice_cr_qp_offset = i4_value;
}
ps_slice_hdr->i1_deblocking_filter_override_flag = 0;
@@ -680,11 +723,19 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec,
if(!ps_slice_hdr->i1_slice_disable_deblocking_filter_flag)
{
- SEV_PARSE("beta_offset_div2", value, ps_bitstrm);
- ps_slice_hdr->i1_beta_offset_div2 = value;
+ SEV_PARSE("beta_offset_div2", i4_value, ps_bitstrm);
+ if(i4_value < -6 || i4_value > 6)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+ ps_slice_hdr->i1_beta_offset_div2 = i4_value;
- SEV_PARSE("tc_offset_div2", value, ps_bitstrm);
- ps_slice_hdr->i1_tc_offset_div2 = value;
+ SEV_PARSE("tc_offset_div2", i4_value, ps_bitstrm);
+ if(i4_value < -6 || i4_value > 6)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+ ps_slice_hdr->i1_tc_offset_div2 = i4_value;
}
}
@@ -819,24 +870,30 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec,
if((ps_pps->i1_tiles_enabled_flag) &&
(ps_pps->i1_entropy_coding_sync_enabled_flag))
{
- max_num_entry_point_offsets = ps_pps->i1_num_tile_columns * (ps_sps->i2_pic_ht_in_ctb - 1);
+ max_num_entry_point_offsets = ps_pps->i1_num_tile_columns * ps_sps->i2_pic_ht_in_ctb - 1;
}
else if(ps_pps->i1_tiles_enabled_flag)
{
- max_num_entry_point_offsets = ps_pps->i1_num_tile_columns * ps_pps->i1_num_tile_rows;
+ max_num_entry_point_offsets = ps_pps->i1_num_tile_columns * ps_pps->i1_num_tile_rows - 1 ;
}
else
{
max_num_entry_point_offsets = (ps_sps->i2_pic_ht_in_ctb - 1);
}
- ps_slice_hdr->i4_num_entry_point_offsets = CLIP3(ps_slice_hdr->i4_num_entry_point_offsets,
- 0, max_num_entry_point_offsets);
+ if(ps_slice_hdr->i4_num_entry_point_offsets < 0 || ps_slice_hdr->i4_num_entry_point_offsets > max_num_entry_point_offsets)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
}
if(ps_slice_hdr->i4_num_entry_point_offsets > 0)
{
UEV_PARSE("offset_len_minus1", value, ps_bitstrm);
+ if(value > 31)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_slice_hdr->i1_offset_len = value + 1;
for(i = 0; i < ps_slice_hdr->i4_num_entry_point_offsets; i++)
@@ -853,6 +910,10 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec,
if(ps_pps->i1_slice_header_extension_present_flag)
{
UEV_PARSE("slice_header_extension_length", value, ps_bitstrm);
+ if(value > 256)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_slice_hdr->i2_slice_header_extension_length = value;
diff --git a/decoder/ihevcd_process_slice.c b/decoder/ihevcd_process_slice.c
index 72db2cc..c5af08e 100644
--- a/decoder/ihevcd_process_slice.c
+++ b/decoder/ihevcd_process_slice.c
@@ -760,13 +760,17 @@ IHEVCD_ERROR_T ihevcd_process(process_ctxt_t *ps_proc)
WORD32 ctb_row, ctb_col, index_pic_map, index_nbr_map;
WORD32 first_pu_of_ctb;
first_pu_of_ctb = pu4_nbr_pu_idx[1 + nbr_pu_idx_strd];
+ UWORD32 cur_ctb_ht_in_min_pu = MIN(((ps_sps->i2_pic_height_in_luma_samples
+ - (ps_proc->i4_ctb_y << ps_sps->i1_log2_ctb_size)) / MIN_PU_SIZE), ctb_size_in_min_pu);
+ UWORD32 cur_ctb_wd_in_min_pu = MIN(((ps_sps->i2_pic_width_in_luma_samples
+ - (ps_proc->i4_ctb_x << ps_sps->i1_log2_ctb_size)) / MIN_PU_SIZE), ctb_size_in_min_pu);
index_pic_map = 0 * ctb_size_in_min_pu + 0;
index_nbr_map = (0 + 1) * nbr_pu_idx_strd + (0 + 1);
- for(ctb_row = 0; ctb_row < ctb_size_in_min_pu; ctb_row++)
+ for(ctb_row = 0; ctb_row < cur_ctb_ht_in_min_pu; ctb_row++)
{
- for(ctb_col = 0; ctb_col < ctb_size_in_min_pu; ctb_col++)
+ for(ctb_col = 0; ctb_col < cur_ctb_wd_in_min_pu; ctb_col++)
{
pu1_pic_pu_map_ctb[index_pic_map + ctb_col] = pu4_nbr_pu_idx[index_nbr_map + ctb_col]
- first_pu_of_ctb;
diff --git a/decoder/ihevcd_ref_list.c b/decoder/ihevcd_ref_list.c
index 0fe6aa4..5f8e135 100644
--- a/decoder/ihevcd_ref_list.c
+++ b/decoder/ihevcd_ref_list.c
@@ -188,7 +188,7 @@ WORD32 ihevcd_ref_list(codec_t *ps_codec, pps_t *ps_pps, sps_t *ps_sps, slice_he
i4_poc_lt = ps_slice_hdr->ai4_poc_lsb_lt[i];
if(ps_slice_hdr->ai1_delta_poc_msb_present_flag[i])
{
- i4_poc_lt += i4_pic_order_cnt_val - ps_slice_hdr->ai1_delta_poc_msb_cycle_lt[i] * u4_max_poc_lsb - ps_slice_hdr->i4_pic_order_cnt_lsb;
+ i4_poc_lt += i4_pic_order_cnt_val - ps_slice_hdr->ai1_delta_poc_msb_cycle_lt[i] * (WORD32)u4_max_poc_lsb - ps_slice_hdr->i4_pic_order_cnt_lsb;
}
if(ps_slice_hdr->ai1_used_by_curr_pic_lt_flag[i])
diff --git a/decoder/ihevcd_sao.c b/decoder/ihevcd_sao.c
index dc852c6..3940b6a 100644
--- a/decoder/ihevcd_sao.c
+++ b/decoder/ihevcd_sao.c
@@ -274,7 +274,7 @@ void ihevcd_sao_ctb(sao_ctxt_t *ps_sao_ctxt)
u4_no_loop_filter_flag >>= (CTZ(~u4_no_loop_filter_flag));
pu1_src_tmp += MIN((WORD32)CTZ(~u4_no_loop_filter_flag), tmp_wd);
pu1_src_copy += MIN((WORD32)CTZ(~u4_no_loop_filter_flag), tmp_wd);
- tmp_wd -= CTZ(~u4_no_loop_filter_flag) * min_cu;
+ tmp_wd -= (WORD32)(CTZ(~u4_no_loop_filter_flag) * min_cu);
}
}
@@ -337,7 +337,7 @@ void ihevcd_sao_ctb(sao_ctxt_t *ps_sao_ctxt)
u4_no_loop_filter_flag >>= (CTZ(u4_no_loop_filter_flag));
pu1_src_tmp += MIN((WORD32)CTZ(u4_no_loop_filter_flag), tmp_wd);
pu1_src_copy += MIN((WORD32)CTZ(u4_no_loop_filter_flag), tmp_wd);
- tmp_wd -= CTZ(u4_no_loop_filter_flag) * min_cu;
+ tmp_wd -= (WORD32)(CTZ(u4_no_loop_filter_flag) * min_cu);
}
else
{
@@ -352,7 +352,7 @@ void ihevcd_sao_ctb(sao_ctxt_t *ps_sao_ctxt)
u4_no_loop_filter_flag >>= (CTZ(~u4_no_loop_filter_flag));
pu1_src_tmp += MIN((WORD32)CTZ(~u4_no_loop_filter_flag), tmp_wd);
pu1_src_copy += MIN((WORD32)CTZ(~u4_no_loop_filter_flag), tmp_wd);
- tmp_wd -= CTZ(~u4_no_loop_filter_flag) * min_cu;
+ tmp_wd -= (WORD32)(CTZ(~u4_no_loop_filter_flag) * min_cu);
}
}
@@ -407,7 +407,7 @@ void ihevcd_sao_ctb(sao_ctxt_t *ps_sao_ctxt)
u4_no_loop_filter_flag >>= (CTZ(u4_no_loop_filter_flag));
pu1_src_tmp += MIN((WORD32)CTZ(u4_no_loop_filter_flag), tmp_wd);
pu1_src_copy += MIN((WORD32)CTZ(u4_no_loop_filter_flag), tmp_wd);
- tmp_wd -= CTZ(u4_no_loop_filter_flag) * min_cu;
+ tmp_wd -= (WORD32)(CTZ(u4_no_loop_filter_flag) * min_cu);
}
else
{
@@ -422,7 +422,7 @@ void ihevcd_sao_ctb(sao_ctxt_t *ps_sao_ctxt)
u4_no_loop_filter_flag >>= (CTZ(~u4_no_loop_filter_flag));
pu1_src_tmp += MIN((WORD32)CTZ(~u4_no_loop_filter_flag), tmp_wd);
pu1_src_copy += MIN((WORD32)CTZ(~u4_no_loop_filter_flag), tmp_wd);
- tmp_wd -= CTZ(~u4_no_loop_filter_flag) * min_cu;
+ tmp_wd -= (WORD32)(CTZ(~u4_no_loop_filter_flag) * min_cu);
}
}
@@ -491,7 +491,7 @@ void ihevcd_sao_ctb(sao_ctxt_t *ps_sao_ctxt)
u4_no_loop_filter_flag >>= (CTZ(u4_no_loop_filter_flag));
pu1_src_tmp += MIN((WORD32)CTZ(u4_no_loop_filter_flag), tmp_wd);
pu1_src_copy += MIN((WORD32)CTZ(u4_no_loop_filter_flag), tmp_wd);
- tmp_wd -= CTZ(u4_no_loop_filter_flag) * min_cu;
+ tmp_wd -= (WORD32)(CTZ(u4_no_loop_filter_flag) * min_cu);
}
else
{
@@ -506,7 +506,7 @@ void ihevcd_sao_ctb(sao_ctxt_t *ps_sao_ctxt)
u4_no_loop_filter_flag >>= (CTZ(~u4_no_loop_filter_flag));
pu1_src_tmp += MIN((WORD32)CTZ(~u4_no_loop_filter_flag), tmp_wd);
pu1_src_copy += MIN((WORD32)CTZ(~u4_no_loop_filter_flag), tmp_wd);
- tmp_wd -= CTZ(~u4_no_loop_filter_flag) * min_cu;
+ tmp_wd -= (WORD32)(CTZ(~u4_no_loop_filter_flag) * min_cu);
}
}
@@ -669,7 +669,7 @@ void ihevcd_sao_shift_ctb(sao_ctxt_t *ps_sao_ctxt)
{
pu1_src_tmp_luma += MIN((WORD32)(CTZ(u4_no_loop_filter_flag) << log2_min_cu), tmp_wd);
pu1_src_backup_luma += MIN((WORD32)(CTZ(u4_no_loop_filter_flag) << log2_min_cu), tmp_wd);
- tmp_wd -= CTZ(u4_no_loop_filter_flag) << log2_min_cu;
+ tmp_wd -= (WORD32)(CTZ(u4_no_loop_filter_flag) << log2_min_cu);
u4_no_loop_filter_flag >>= (CTZ(u4_no_loop_filter_flag));
}
else
@@ -683,7 +683,7 @@ void ihevcd_sao_shift_ctb(sao_ctxt_t *ps_sao_ctxt)
}
pu1_src_tmp_luma += MIN(((WORD32)CTZ(~u4_no_loop_filter_flag) << log2_min_cu), tmp_wd);
pu1_src_backup_luma += MIN(((WORD32)CTZ(~u4_no_loop_filter_flag) << log2_min_cu), tmp_wd);
- tmp_wd -= CTZ(~u4_no_loop_filter_flag) << log2_min_cu;
+ tmp_wd -= (WORD32)(CTZ(~u4_no_loop_filter_flag) << log2_min_cu);
u4_no_loop_filter_flag >>= (CTZ(~u4_no_loop_filter_flag));
}
}
@@ -748,7 +748,7 @@ void ihevcd_sao_shift_ctb(sao_ctxt_t *ps_sao_ctxt)
{
pu1_src_tmp_chroma += MIN(((WORD32)CTZ(u4_no_loop_filter_flag) << log2_min_cu), tmp_wd);
pu1_src_backup_chroma += MIN(((WORD32)CTZ(u4_no_loop_filter_flag) << log2_min_cu), tmp_wd);
- tmp_wd -= CTZ(u4_no_loop_filter_flag) << log2_min_cu;
+ tmp_wd -= (WORD32)(CTZ(u4_no_loop_filter_flag) << log2_min_cu);
u4_no_loop_filter_flag >>= (CTZ(u4_no_loop_filter_flag));
}
else
@@ -763,7 +763,7 @@ void ihevcd_sao_shift_ctb(sao_ctxt_t *ps_sao_ctxt)
pu1_src_tmp_chroma += MIN(((WORD32)CTZ(~u4_no_loop_filter_flag) << log2_min_cu), tmp_wd);
pu1_src_backup_chroma += MIN(((WORD32)CTZ(~u4_no_loop_filter_flag) << log2_min_cu), tmp_wd);
- tmp_wd -= CTZ(~u4_no_loop_filter_flag) << log2_min_cu;
+ tmp_wd -= (WORD32)(CTZ(~u4_no_loop_filter_flag) << log2_min_cu);
u4_no_loop_filter_flag >>= (CTZ(~u4_no_loop_filter_flag));
}
}
@@ -3392,7 +3392,7 @@ void ihevcd_sao_shift_ctb(sao_ctxt_t *ps_sao_ctxt)
{
pu1_src_tmp_luma += MIN(((WORD32)CTZ(u4_no_loop_filter_flag) << log2_min_cu), tmp_wd);
pu1_src_backup_luma += MIN(((WORD32)CTZ(u4_no_loop_filter_flag) << log2_min_cu), tmp_wd);
- tmp_wd -= CTZ(u4_no_loop_filter_flag) << log2_min_cu;
+ tmp_wd -= (WORD32)(CTZ(u4_no_loop_filter_flag) << log2_min_cu);
u4_no_loop_filter_flag >>= (CTZ(u4_no_loop_filter_flag));
}
else
@@ -3406,7 +3406,7 @@ void ihevcd_sao_shift_ctb(sao_ctxt_t *ps_sao_ctxt)
}
pu1_src_tmp_luma += MIN(((WORD32)CTZ(~u4_no_loop_filter_flag) << log2_min_cu), tmp_wd);
pu1_src_backup_luma += MIN(((WORD32)CTZ(~u4_no_loop_filter_flag) << log2_min_cu), tmp_wd);
- tmp_wd -= CTZ(~u4_no_loop_filter_flag) << log2_min_cu;
+ tmp_wd -= (WORD32)(CTZ(~u4_no_loop_filter_flag) << log2_min_cu);
u4_no_loop_filter_flag >>= (CTZ(~u4_no_loop_filter_flag));
}
}
@@ -3470,7 +3470,7 @@ void ihevcd_sao_shift_ctb(sao_ctxt_t *ps_sao_ctxt)
{
pu1_src_tmp_chroma += MIN(((WORD32)CTZ(u4_no_loop_filter_flag) << log2_min_cu), tmp_wd);
pu1_src_backup_chroma += MIN(((WORD32)CTZ(u4_no_loop_filter_flag) << log2_min_cu), tmp_wd);
- tmp_wd -= CTZ(u4_no_loop_filter_flag) << log2_min_cu;
+ tmp_wd -= (WORD32)(CTZ(u4_no_loop_filter_flag) << log2_min_cu);
u4_no_loop_filter_flag >>= (CTZ(u4_no_loop_filter_flag));
}
else
@@ -3485,7 +3485,7 @@ void ihevcd_sao_shift_ctb(sao_ctxt_t *ps_sao_ctxt)
pu1_src_tmp_chroma += MIN(((WORD32)CTZ(~u4_no_loop_filter_flag) << log2_min_cu), tmp_wd);
pu1_src_backup_chroma += MIN(((WORD32)CTZ(~u4_no_loop_filter_flag) << log2_min_cu), tmp_wd);
- tmp_wd -= CTZ(~u4_no_loop_filter_flag) << log2_min_cu;
+ tmp_wd -= (WORD32)(CTZ(~u4_no_loop_filter_flag) << log2_min_cu);
u4_no_loop_filter_flag >>= (CTZ(~u4_no_loop_filter_flag));
}
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-11 23:54:53 +0000