Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Oss fuzz svcdec fixes #89

Merged
merged 4 commits into from
Dec 11, 2023
Merged

Oss fuzz svcdec fixes #89

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6af23d2
Fixes for heap overflow
MallikarjunKamble Dec 6, 2023
ae49151
Added fixes for hang
MallikarjunKamble Dec 8, 2023
e4e7257
Added compliance fixes
MallikarjunKamble Dec 11, 2023
0f1f8dd
Update intra resamp flags
MallikarjunKamble Dec 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions decoder/svc/isvcd_api.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2619,7 +2619,7 @@ WORD32 isvcd_allocate_static_bufs(iv_obj_t **dec_hdl, void *pv_api_ip, void *pv_
ps_svc_lyr_dec->u1_dyadic_flag = 1;
ps_svc_lyr_dec->u1_restricted_res_change_flag = 1;
ps_svc_lyr_dec->u1_base_res_flag = 1;
ps_svc_lyr_dec->u1_ref_layer_id = 0;
ps_svc_lyr_dec->u1_ref_layer_id = u1_layer_id - 1;
ps_svc_lyr_dec->ps_dec_svc_ref_layer =
&ps_svcd_ctxt->ps_svc_dec_lyr[ps_svc_lyr_dec->u1_ref_layer_id];
ps_svc_lyr_dec->u4_pps_id_for_layer = UINT32_MAX;
Expand Down Expand Up @@ -5320,7 +5320,7 @@ WORD32 isvcd_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
ps_dec = &ps_svc_lyr_dec->s_dec;

if((0 == ps_svcd_ctxt->u4_num_sps_ctr) || (0 == ps_svcd_ctxt->u4_num_pps_ctr) ||
(NULL == ps_dec->ps_cur_pps))
(NULL == ps_dec->ps_cur_pps) || (ps_svc_lyr_dec->u1_res_init_done == 0))
{
ps_svcd_ctxt->u1_exit_till_next_IDR = 1;
ps_dec_op->u4_error_code = ERROR_UNKNOWN_NAL;
Expand Down
39 changes: 39 additions & 0 deletions decoder/svc/isvcd_intra_resamp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4934,6 +4934,45 @@ void isvcd_crop_wnd_flag_res_int(void *pv_svc_dec)
}
}

/*****************************************************************************/
/* */
/* Function Name : isvcd_intra_resamp_res_init */
/* */
/* Description : this function calculates the scale factors and initialise*/
/* the context structure */
/* */
/* Inputs : pv_intra_samp_ctxt: handle to private structure */
/* ps_curr_lyr_res_prms: pointer to current resolution */
/* params */
/* ps_ref_lyr_res_prms : pointer to ref resolution params */
/* Globals : none */
/* Processing : it stores the layer dimensions */
/* */
/* Outputs : none */
/* Returns : none */
/* */
/* Issues : none */
/* */
/* Revision History: */
/* */
/* DD MM YYYY Author(s) Changes (Describe the changes made) */
/* 26 08 2021 vijayakumar creation */
/* */
/*****************************************************************************/
void isvcd_intra_resamp_res_init_update_flags(void *pv_svc_dec)
{
intra_sampling_ctxt_t *ps_ctxt;
intra_samp_lyr_ctxt *ps_lyr_ctxt;
svc_dec_lyr_struct_t *ps_svc_lyr_dec = (svc_dec_lyr_struct_t *) pv_svc_dec;

ps_ctxt = (intra_sampling_ctxt_t *) ps_svc_lyr_dec->pv_intra_sample_ctxt;;
/* get the current layer ctxt */
ps_lyr_ctxt = &ps_ctxt->as_res_lyrs[ps_svc_lyr_dec->u1_layer_id - 1];

ps_lyr_ctxt->i1_constrained_intra_rsmpl_flag =
ps_svc_lyr_dec->s_svc_slice_params.u1_constrained_intra_resampling_flag;
}

/*****************************************************************************/
/* */
/* Function Name : isvcd_intra_resamp_res_init */
Expand Down
2 changes: 2 additions & 0 deletions decoder/svc/isvcd_intra_resamp.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -628,4 +628,6 @@ void isvcd_crop_wnd_flag_res_int(void *ps_svc_dec);

WORD32 isvcd_intra_resamp_res_init(void *ps_svc_dec);

void isvcd_intra_resamp_res_init_update_flags(void *ps_svc_dec);

#endif /* _ISVCD_INTRA_RESAMPLE_H_ */
11 changes: 0 additions & 11 deletions decoder/svc/isvcd_parse_ebslice.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1791,12 +1791,6 @@ WORD32 isvcd_parse_ebslice(svc_dec_lyr_struct_t *ps_svc_lyr_dec, UWORD16 u2_firs
return ERROR_INV_SLICE_HDR_T;
}

ret = isvcd_parse_interlayer_resamp_func_init(ps_svc_lyr_dec, u2_first_mb_in_slice);
if(ret != OK)
{
return ERROR_CORRUPTED_SLICE;
}

ps_dec->u1_slice_header_done = 2;
if(!ps_svc_slice_params->u1_slice_skip_flag)
{
Expand Down Expand Up @@ -2131,11 +2125,6 @@ WORD32 isvcd_parse_bslice(svc_dec_lyr_struct_t *ps_svc_lyr_dec, UWORD16 u2_first
ps_slice->i1_slice_beta_offset = 0;
}

ret = isvcd_parse_interlayer_resamp_func_init(ps_svc_lyr_dec, u2_first_mb_in_slice);
if(ret != OK)
{
return ERROR_CORRUPTED_SLICE;
}
ps_dec->u1_slice_header_done = 2;

if(ps_pps->u1_entropy_coding_mode)
Expand Down
10 changes: 0 additions & 10 deletions decoder/svc/isvcd_parse_eislice.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1127,11 +1127,6 @@ WORD32 isvcd_parse_eislice(svc_dec_lyr_struct_t *ps_svc_lyr_dec, UWORD16 u2_firs
ps_dec->u2_mv_2mb[0] = 0;
ps_dec->u2_mv_2mb[1] = 0;

ret = isvcd_parse_interlayer_resamp_func_init(ps_svc_lyr_dec, u2_first_mb_in_slice);
if(ret != OK)
{
return ERROR_CORRUPTED_SLICE;
}
/*set slice header cone to 2 ,to indicate correct header*/
ps_dec->u1_slice_header_done = 2;

Expand Down Expand Up @@ -2064,11 +2059,6 @@ WORD32 isvcd_parse_islice(svc_dec_lyr_struct_t *ps_svc_lyr_dec, UWORD16 u2_first
ps_dec->u2_mv_2mb[0] = 0;
ps_dec->u2_mv_2mb[1] = 0;

ret = isvcd_parse_interlayer_resamp_func_init(ps_svc_lyr_dec, u2_first_mb_in_slice);
if(ret != OK)
{
return ERROR_CORRUPTED_SLICE;
}
/*set slice header cone to 2 ,to indicate correct header*/
ps_dec->u1_slice_header_done = 2;
if(ps_pps->u1_entropy_coding_mode)
Expand Down
7 changes: 0 additions & 7 deletions decoder/svc/isvcd_parse_epslice.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -425,11 +425,6 @@ WORD32 isvcd_parse_epslice(svc_dec_lyr_struct_t *ps_svc_lyr_dec, UWORD16 u2_firs
return ERROR_INV_SLICE_HDR_T;
}

ret = isvcd_parse_interlayer_resamp_func_init(ps_svc_lyr_dec, u2_first_mb_in_slice);
if(ret != OK)
{
return ERROR_CORRUPTED_SLICE;
}
ps_dec->u1_slice_header_done = 2;

if(!ps_svc_slice_params->u1_slice_skip_flag)
Expand Down Expand Up @@ -3465,8 +3460,6 @@ WORD32 isvcd_parse_pslice(svc_dec_lyr_struct_t *ps_svc_lyr_dec, UWORD16 u2_first
ps_cur_slice->i1_slice_beta_offset = 0;
}

isvcd_parse_interlayer_resamp_func_init(ps_svc_lyr_dec, u2_first_mb_in_slice);

ps_dec->u1_slice_header_done = 2;
if(ps_pps->u1_entropy_coding_mode)
{
Expand Down
38 changes: 36 additions & 2 deletions decoder/svc/isvcd_parse_slice.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -703,6 +703,14 @@ WORD32 isvcd_parse_decode_slice_ext_nal(UWORD8 u1_is_idr_slice, UWORD8 u1_nal_re
return ERROR_CORRUPTED_SLICE;
}

if(ps_dec->u4_first_slice_in_pic == 1)
{
if(u2_first_mb_in_slice != 0)
{
return ERROR_CORRUPTED_SLICE;
}
}

COPYTHECONTEXT("Slice Header SVC ext: first_mb_in_slice", u2_first_mb_in_slice);

u4_temp = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
Expand Down Expand Up @@ -1202,8 +1210,13 @@ WORD32 isvcd_parse_decode_slice_ext_nal(UWORD8 u1_is_idr_slice, UWORD8 u1_nal_re
else
ps_dec->u4_output_present = 1;
}
ret = isvcd_parse_interlayer_resamp_func_init(ps_svc_lyr_dec, u2_first_mb_in_slice);
if(ret != OK)
{
return ERROR_CORRUPTED_SLICE;
}
if((ps_dec->u1_separate_parse == 1) &&
(ps_svc_lyr_dec->u1_layer_identifier == TARGET_LAYER))
(ps_svc_lyr_dec->u1_layer_identifier == TARGET_LAYER) && (ps_svc_lyr_dec->u1_res_init_done == 1))
{
if(ps_dec->u4_dec_thread_created == 0)
{
Expand Down Expand Up @@ -1635,11 +1648,14 @@ WORD32 isvcd_parse_slice_header(svc_dec_lyr_struct_t *ps_svc_lyr_dec)
{
return ERROR_INV_SLICE_HDR_T;
}
/* Reference layer id update is taken care during resolution init */
/*
ps_svc_lyr_dec->u1_ref_layer_id = ps_svc_slice_params->u4_ref_layer_dq_id >> 4;
if(ps_svc_lyr_dec->u1_ref_layer_id >= ps_svc_lyr_dec->u1_layer_id)
{
return ERROR_INV_SLICE_HDR_T;
}
*/
ps_svc_lyr_dec->ps_dec_svc_ref_layer =
&ps_svcd_ctxt->ps_svc_dec_lyr[ps_svc_lyr_dec->u1_ref_layer_id];

Expand Down Expand Up @@ -1684,6 +1700,11 @@ WORD32 isvcd_parse_slice_header(svc_dec_lyr_struct_t *ps_svc_lyr_dec)
ps_svc_slice_params->u1_constrained_intra_resampling_flag = ih264d_get_bit_h264(ps_bitstrm);
COPYTHECONTEXT("Slice Header SVC ext: u1_constrained_intra_resampling_flag",
ps_svc_slice_params->u1_constrained_intra_resampling_flag);

ps_svc_lyr_dec->s_res_prms.i1_constrained_intra_rsmpl_flag =
ps_svc_lyr_dec->s_svc_slice_params.u1_constrained_intra_resampling_flag;
isvcd_intra_resamp_res_init_update_flags(ps_svc_lyr_dec);

if(2 == ps_sps_svc_ext->u1_extended_spatial_scalability_idc)
{
/* ChromaArrayType = i4_chroma_format_idc if separate_colour_plane_flag
Expand Down Expand Up @@ -1926,6 +1947,14 @@ WORD32 isvcd_parse_decode_slice(UWORD8 u1_is_idr_slice, UWORD8 u1_nal_ref_idc,
return ERROR_CORRUPTED_SLICE;
}

if(ps_dec->u4_first_slice_in_pic == 1)
{
if(u2_first_mb_in_slice != 0)
{
return ERROR_CORRUPTED_SLICE;
}
}

COPYTHECONTEXT("SH: first_mb_in_slice", u2_first_mb_in_slice);

u4_temp = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
Expand Down Expand Up @@ -2421,7 +2450,12 @@ WORD32 isvcd_parse_decode_slice(UWORD8 u1_is_idr_slice, UWORD8 u1_nal_ref_idc,
else
ps_dec->u4_output_present = 1;
}
if(ps_dec->u1_separate_parse == 1)
ret = isvcd_parse_interlayer_resamp_func_init(ps_svc_lyr_dec, u2_first_mb_in_slice);
if(ret != OK)
{
return ERROR_CORRUPTED_SLICE;
}
if((ps_dec->u1_separate_parse == 1) && (ps_svc_lyr_dec->u1_res_init_done == 1))
{
if(ps_dec->u4_dec_thread_created == 0)
{
Expand Down
33 changes: 0 additions & 33 deletions decoder/svc/isvcd_process_epslice.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,39 +158,6 @@ WORD32 isvcd_interlyr_motion_mode_pred(svc_dec_lyr_struct_t *ps_svc_lyr_dec,
/* get the current layer ctxt */
ps_lyr_mem = &ps_ctxt->as_res_lyr_mem[ps_ctxt->i4_res_id];

/* In case of error mb_mode is set to skip */
if(ps_svc_lyr_dec->u1_res_init_done == 0)
{
mv_pred_t *ps_motion_pred;
ps_motion_pred = ps_ctxt->ps_motion_pred_struct;
ps_motion_pred = ps_ctxt->ps_motion_pred_struct;
memset(ps_motion_pred, 0, sizeof(mv_pred_t));

i4_mb_mode = -1;
ps_cur_mb_info->u1_mb_type = MB_SKIP;
ps_mb_part_info->u1_num_part = 1;

ps_cur_mb_info->u1_mb_mc_mode = PRED_16x16;
ps_mb_part_info->u1_col_info[0] = (PRED_16x16 << 6);
ps_mb_part_info->i1_ref_idx[0][0] = 0;

ps_svc_cur_mb_info->u1_residual_prediction_flag = 0;
ps_svc_cur_mb_info->au1_motion_pred_flag[0] = 0;
ps_svc_cur_mb_info->au1_motion_pred_flag[1] = 0;
ps_svc_cur_mb_info->u1_base_mode_flag = 0;

ps_part->u1_partwidth = 4; // interms of 4x4
ps_part->u1_partheight = 4;
ps_part->u1_pred_mode = PRED_L0;
ps_part->u1_is_direct = 0;
ps_part->u1_sub_mb_num = 0;

if(2 == i4_listx)
{
ps_mb_part_info->i1_ref_idx[1][0] = -1;
}
}
else
{
ps_ctxt->i4_listx = i4_listx;

Expand Down