Sanity check parsed QP values from H264 bitstream

webrtc/common_video/h264/h264_bitstream_parser.cc

 /*
  *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 #include "webrtc/common_video/h264/h264_bitstream_parser.h"
 
 #include <memory>
 #include <vector>
 
 #include "webrtc/base/bitbuffer.h"
 #include "webrtc/base/bytebuffer.h"
 #include "webrtc/base/checks.h"
 
 #include "webrtc/common_video/h264/h264_common.h"
 #include "webrtc/base/logging.h"
 
+namespace {
+const int kMaxAbsQpDeltaValue = 51;
+}
+
 namespace webrtc {
 
 #define RETURN_ON_FAIL(x, res)        \
   if (!(x)) {                         \
     LOG_F(LS_ERROR) << "FAILED: " #x; \
     return res;                       \
   }
 
 #define RETURN_INV_ON_FAIL(x) RETURN_ON_FAIL(x, kInvalidStream)
 
@@ skipping 212 matching lines @@
   }
   if (pps_->entropy_coding_mode_flag &&
       slice_type != H264::SliceType::kI && slice_type != H264::SliceType::kSi) {
     // cabac_init_idc: ue(v)
     RETURN_INV_ON_FAIL(slice_reader.ReadExponentialGolomb(&golomb_tmp));
   }
 
   int32_t last_slice_qp_delta;
   RETURN_INV_ON_FAIL(
       slice_reader.ReadSignedExponentialGolomb(&last_slice_qp_delta));
+  if (abs(last_slice_qp_delta) > kMaxAbsQpDeltaValue) {

[pbos-webrtc, 2016/11/29 15:31:50]

"The value of slice_qp_delta shall be limited such that SliceQPY is in the range
of −QpBdOffsetY to +51, inclusive."

Shouldn't this be between 0 and 51, not -51?

[pbos-webrtc, 2016/11/29 16:12:42]

Sorry, e.g. should this range be depending on pps_, instead of -51 and 51?

+    // Something has gone wrong, and the parsed value is invalid.
+    LOG(LS_WARNING) << "Parsed QP value out of range.";
+    return kInvalidStream;
+  }
+
   last_slice_qp_delta_ = rtc::Optional<int32_t>(last_slice_qp_delta);
   return kOk;
 }
 
 void H264BitstreamParser::ParseSlice(const uint8_t* slice, size_t length) {
   H264::NaluType nalu_type = H264::ParseNaluType(slice[0]);
   switch (nalu_type) {
     case H264::NaluType::kSps: {
       sps_ = SpsParser::ParseSps(slice + H264::kNaluTypeSize,
                                  length - H264::kNaluTypeSize);
@@ skipping 25 matching lines @@
 }
 
 bool H264BitstreamParser::GetLastSliceQp(int* qp) const {
   if (!last_slice_qp_delta_ || !pps_)
     return false;
   *qp = 26 + pps_->pic_init_qp_minus26 + *last_slice_qp_delta_;
   return true;
 }
 
 }  // namespace webrtc