shithub: libvpx

Info  •  Files  •  Log  •  Branches

vp10: disallow coding zero-sized tiles-in-frame/frames-in-superframe.

See issue 1088.

Change-Id: Icb15d33b4e316add848f210b50cbccd7c7847207

--- a/vp10/decoder/decodeframe.c

+++ b/vp10/decoder/decodeframe.c

@@ -1448,9 +1448,9 @@

     if (decrypt_cb) {

       uint8_t be_data[4];

       decrypt_cb(decrypt_state, *data, be_data, tile_sz_mag + 1);

-      size = mem_get_varsize(be_data, tile_sz_mag);

+      size = mem_get_varsize(be_data, tile_sz_mag) + CONFIG_MISC_FIXES;

     } else {

-      size = mem_get_varsize(*data, tile_sz_mag);

+      size = mem_get_varsize(*data, tile_sz_mag) + CONFIG_MISC_FIXES;

     }

     *data += tile_sz_mag + 1;

--- a/vp10/decoder/decoder.c

+++ b/vp10/decoder/decoder.c

@@ -506,6 +506,7 @@

         for (j = 0; j < mag; ++j)

           this_sz |= (*x++) << (j * 8);

+        this_sz += CONFIG_MISC_FIXES;

         sizes[i] = this_sz;

 #if CONFIG_MISC_FIXES

         frame_sz_sum += this_sz;

--- a/vp10/encoder/bitstream.c

+++ b/vp10/encoder/bitstream.c

@@ -1117,9 +1117,13 @@

       assert(tok == tok_end);

       vpx_stop_encode(&residual_bc);

       if (tile_col < tile_cols - 1 || tile_row < tile_rows - 1) {

+        unsigned int tile_sz;

+

         // size of this tile

-        mem_put_le32(data_ptr + total_size, residual_bc.pos);

-        max_tile = max_tile > residual_bc.pos ? max_tile : residual_bc.pos;

+        assert(residual_bc.pos > 0);

+        tile_sz = residual_bc.pos - CONFIG_MISC_FIXES;

+        mem_put_le32(data_ptr + total_size, tile_sz);

+        max_tile = max_tile > tile_sz ? max_tile : tile_sz;

         total_size += 4;

       }

--- a/vp10/vp10_cx_iface.c

+++ b/vp10/vp10_cx_iface.c

@@ -795,7 +795,7 @@

   marker |= ctx->pending_frame_count - 1;

 #if CONFIG_MISC_FIXES

   for (i = 0; i < ctx->pending_frame_count - 1; i++) {

-    const size_t frame_sz = (unsigned int) ctx->pending_frame_sizes[i];

+    const size_t frame_sz = (unsigned int) ctx->pending_frame_sizes[i] - 1;

     max_frame_sz = frame_sz > max_frame_sz ? frame_sz : max_frame_sz;

   }

 #endif

@@ -836,8 +836,10 @@

     *x++ = marker;

     for (i = 0; i < ctx->pending_frame_count - CONFIG_MISC_FIXES; i++) {

-      unsigned int this_sz = (unsigned int)ctx->pending_frame_sizes[i];

+      unsigned int this_sz;

+      assert(ctx->pending_frame_sizes[i] > 0);

+      this_sz = (unsigned int)ctx->pending_frame_sizes[i] - CONFIG_MISC_FIXES;

       for (j = 0; j <= mag; j++) {

         *x++ = this_sz & 0xff;

         this_sz >>= 8;