Sanity check parsed QP values from H264 bitstream

webrtc/common_video/h264/h264_bitstream_parser.cc

 /*
  *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 #include "webrtc/common_video/h264/h264_bitstream_parser.h"
 
 #include <memory>
 #include <vector>
 
 #include "webrtc/base/bitbuffer.h"
 #include "webrtc/base/bytebuffer.h"
 #include "webrtc/base/checks.h"
 
 #include "webrtc/common_video/h264/h264_common.h"
 #include "webrtc/base/logging.h"
 
+namespace {
+const int kMaxAbsQpDeltaValue = 51;
+const int kMinQpValue = 0;
+const int kMaxQpValue = 51;
+}
+
 namespace webrtc {
 
 #define RETURN_ON_FAIL(x, res)        \
   if (!(x)) {                         \
     LOG_F(LS_ERROR) << "FAILED: " #x; \
     return res;                       \
   }
 
 #define RETURN_INV_ON_FAIL(x) RETURN_ON_FAIL(x, kInvalidStream)
 
@@ skipping 212 matching lines @@
   }
   if (pps_->entropy_coding_mode_flag &&
       slice_type != H264::SliceType::kI && slice_type != H264::SliceType::kSi) {
     // cabac_init_idc: ue(v)
     RETURN_INV_ON_FAIL(slice_reader.ReadExponentialGolomb(&golomb_tmp));
   }
 
   int32_t last_slice_qp_delta;
   RETURN_INV_ON_FAIL(
       slice_reader.ReadSignedExponentialGolomb(&last_slice_qp_delta));
+  if (abs(last_slice_qp_delta) > kMaxAbsQpDeltaValue) {
+    // Something has gone wrong, and the parsed value is invalid.
+    LOG(LS_WARNING) << "Parsed QP value out of range.";
+    return kInvalidStream;
+  }
+
   last_slice_qp_delta_ = rtc::Optional<int32_t>(last_slice_qp_delta);
   return kOk;
 }
 
 void H264BitstreamParser::ParseSlice(const uint8_t* slice, size_t length) {
   H264::NaluType nalu_type = H264::ParseNaluType(slice[0]);
   switch (nalu_type) {
     case H264::NaluType::kSps: {
       sps_ = SpsParser::ParseSps(slice + H264::kNaluTypeSize,
                                  length - H264::kNaluTypeSize);
@@ skipping 20 matching lines @@
                                          size_t length) {
   std::vector<H264::NaluIndex> nalu_indices =
       H264::FindNaluIndices(bitstream, length);
   for (const H264::NaluIndex& index : nalu_indices)
     ParseSlice(&bitstream[index.payload_start_offset], index.payload_size);
 }
 
 bool H264BitstreamParser::GetLastSliceQp(int* qp) const {
   if (!last_slice_qp_delta_ || !pps_)
     return false;
-  *qp = 26 + pps_->pic_init_qp_minus26 + *last_slice_qp_delta_;
+  const int parsed_qp = 26 + pps_->pic_init_qp_minus26 + *last_slice_qp_delta_;
+  if (parsed_qp < kMinQpValue || parsed_qp > kMaxQpValue) {
+    LOG(LS_ERROR) << "Parsed invalid QP from bitstream.";
+    return false;
+  }
+  *qp = parsed_qp;
   return true;
 }
 
 }  // namespace webrtc