Fix the issue of undefined-shift in VP8GetBit.

webrtc/modules/video_coding/utility/vp8_header_parser.cc

Index: webrtc/modules/video_coding/utility/vp8_header_parser.cc
diff --git a/webrtc/modules/video_coding/utility/vp8_header_parser.cc b/webrtc/modules/video_coding/utility/vp8_header_parser.cc
index 631385d0f25095903e676f79dc24e04ea1e1c6cd..5028ade6cf5dc391b9a0db5574725cac64616452 100644
--- a/webrtc/modules/video_coding/utility/vp8_header_parser.cc
+++ b/webrtc/modules/video_coding/utility/vp8_header_parser.cc
@@ -17,6 +17,7 @@ namespace vp8 {
 namespace {
 const size_t kCommonPayloadHeaderLength = 3;
 const size_t kKeyPayloadHeaderLength = 10;
+const size_t kParseError = 0;
 }  // namespace
 
 static uint32_t BSwap32(uint32_t x) {
@@ -78,6 +79,10 @@ static int VP8GetBit(VP8BitReader* const br, int prob) {
 
   const int pos = br->bits_;
   const uint8_t split = (range * prob) >> 8;
+  if (pos < 0) {
+    pos = 0;

[pbos-webrtc, 2016/04/15 08:58:58]

Also log an error in here, but I think you should do that when bits_ is read
instead and not here. This is not where the error occurs, br->bits_ shouldn't be
able to be negative right?

[jackychen_, 2016/04/15 20:24:50]

Right, it must be an invalid bitstream.

+    kParseError = 1;

[pbos-webrtc, 2016/04/15 08:58:58]

Does this even compile? You shouldn't modify global state in this code.

[jackychen_, 2016/04/15 20:24:50]

Done.

+  }
   const uint8_t value = static_cast<uint8_t>(br->value_ >> pos);
   int bit;
   if (value > split) {
@@ -170,6 +175,7 @@ bool GetQp(const uint8_t* buf, size_t length, int* qp) {
   // Size of first partition in bytes.
   uint32_t partition_length = (bits >> 5);
   size_t header_length = kCommonPayloadHeaderLength;
+  kParseError = 0;

[pbos-webrtc, 2016/04/15 08:58:58]

Should this not be a property of the bitreader?

[jackychen_, 2016/04/15 20:24:50]

Done.

   if (key_frame) {
     header_length = kKeyPayloadHeaderLength;
   }
@@ -196,6 +202,8 @@ bool GetQp(const uint8_t* buf, size_t length, int* qp) {
     return false;
   }
   *qp = base_q0;
+  if (kParseError)
+    return false;
   return true;
 }