Chromium Code Reviews| Index: webrtc/modules/video_coding/utility/vp8_header_parser.cc |
| diff --git a/webrtc/modules/video_coding/utility/vp8_header_parser.cc b/webrtc/modules/video_coding/utility/vp8_header_parser.cc |
| index 0b0bfa235ce9c74987029610029180cff9aa2357..cc6715ad1c4136484ef4bba76321deba8a4893d2 100644 |
| --- a/webrtc/modules/video_coding/utility/vp8_header_parser.cc |
| +++ b/webrtc/modules/video_coding/utility/vp8_header_parser.cc |
| @@ -15,6 +15,10 @@ |
| namespace webrtc { |
| namespace vp8 { |
| +namespace { |
| +const size_t kCommonPayloadHdrLength = 3; |
|
stefan-webrtc
2015/10/15 12:49:35
PayloadHdr -> PayloadHeader
åsapersson
2015/10/16 09:33:59
Done.
|
| +const size_t kKeyPayloadHdrLength = 10; |
| +} // namespace |
| static uint32_t BSwap32(uint32_t x) { |
| return (x >> 24) | ((x >> 8) & 0xff00) | ((x << 8) & 0xff0000) | (x << 24); |
| @@ -156,18 +160,24 @@ static void ParseFilterHeader(VP8BitReader* br) { |
| } |
| } |
| -int GetQP(uint8_t* buf) { |
| +bool GetQp(const uint8_t* buf, size_t length, int* qp) { |
| + if (length < kCommonPayloadHdrLength) { |
| + return false; |
| + } |
| VP8BitReader br; |
| const uint32_t bits = buf[0] | (buf[1] << 8) | (buf[2] << 16); |
| int key_frame = !(bits & 1); |
| // Size of first partition in bytes. |
| - int partition_length = (bits >> 5); |
| - // Skip past uncompressed header: 10bytes for key, 3bytes for delta frames. |
| + uint32_t partition_length = (bits >> 5); |
| + size_t header_length = kCommonPayloadHdrLength; |
| if (key_frame) { |
| - buf += 10; |
| - } else { |
| - buf += 3; |
| + header_length = kKeyPayloadHdrLength; |
| + } |
| + if (header_length + partition_length > length) { |
| + return false; |
| } |
| + buf += header_length; |
| + |
| VP8InitBitReader(&br, buf, buf + partition_length); |
| if (key_frame) { |
| // Color space and pixel type. |
| @@ -180,7 +190,12 @@ int GetQP(uint8_t* buf) { |
| VP8GetValue(&br, 2); |
| // Base QP. |
| const int base_q0 = VP8GetValue(&br, 7); |
| - return base_q0; |
| + if (br.eof_ == 1) { |
| + // End of file should not have been reached. |
| + return false; |
| + } |
| + *qp = base_q0; |
| + return true; |
| } |
| } // namespace vp8 |