Sanity check parsed QP values from H264 bitstream

webrtc/common_video/h264/h264_bitstream_parser.cc

 /*
  *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 #include "webrtc/common_video/h264/h264_bitstream_parser.h"
@@ skipping 233 matching lines @@
   }
   if (pps_->entropy_coding_mode_flag &&
       slice_type != H264::SliceType::kI && slice_type != H264::SliceType::kSi) {
     // cabac_init_idc: ue(v)
     RETURN_INV_ON_FAIL(slice_reader.ReadExponentialGolomb(&golomb_tmp));
   }
 
   int32_t last_slice_qp_delta;
   RETURN_INV_ON_FAIL(
       slice_reader.ReadSignedExponentialGolomb(&last_slice_qp_delta));
+  if (last_slice_qp_delta > 52 || last_slice_qp_delta < -52) {

[magjed_webrtc, 2016/11/28 16:41:32]

Is the constant 52 specified by the spec? We should name it something, like
kMaxAbsQpDeltaValue.

[pbos-webrtc, 2016/11/28 17:15:45]

I think you should also add range checking in GetLastSliceQp which should be the
last step, e.g. something like:

26 + pps_->pic_init_qp_minus26 + *last_slice_qp_delta_ in [0,51]? Otherwise
return false.

If the pps_ should have been set before, then you can make this range check
here.

[kthelgason, 2016/11/29 10:27:12]

Yes, and done.

[kthelgason, 2016/11/29 10:27:12]

Yes, and done.
I added range checks in the pps parser instead, seemed more appropriate.

+    // Something has gone wrong, and the parsed value is invalid.
+    LOG(LS_WARNING) << "Parsed QP value out of range.";
+    return kInvalidStream;
+  }
+
   last_slice_qp_delta_ = rtc::Optional<int32_t>(last_slice_qp_delta);
   return kOk;
 }
 
 void H264BitstreamParser::ParseSlice(const uint8_t* slice, size_t length) {
   H264::NaluType nalu_type = H264::ParseNaluType(slice[0]);
   switch (nalu_type) {
     case H264::NaluType::kSps: {
       sps_ = SpsParser::ParseSps(slice + H264::kNaluTypeSize,
                                  length - H264::kNaluTypeSize);
@@ skipping 25 matching lines @@
 }
 
 bool H264BitstreamParser::GetLastSliceQp(int* qp) const {
   if (!last_slice_qp_delta_ || !pps_)
     return false;
   *qp = 26 + pps_->pic_init_qp_minus26 + *last_slice_qp_delta_;
   return true;
 }
 
 }  // namespace webrtc