Sanity check parsed QP values from H264 bitstream

webrtc/common_video/h264/pps_parser.cc

 /*
  *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
 #include "webrtc/common_video/h264/pps_parser.h"
 
 #include <memory>
 
 #include "webrtc/common_video/h264/h264_common.h"
 #include "webrtc/base/bitbuffer.h"
 #include "webrtc/base/buffer.h"
 #include "webrtc/base/logging.h"
 
 #define RETURN_EMPTY_ON_FAIL(x)                  \
   if (!(x)) {                                    \
     return rtc::Optional<PpsParser::PpsState>(); \
   }
 
+namespace {
+const int kMaxPicInitQpDeltaValue = 25;
+const int kMinPicInitQpDeltaValue = -26;
+}
+
 namespace webrtc {
 
 // General note: this is based off the 02/2014 version of the H.264 standard.
 // You can find it on this page:
 // http://www.itu.int/rec/T-REC-H.264
 
 rtc::Optional<PpsParser::PpsState> PpsParser::ParsePps(const uint8_t* data,
                                                        size_t length) {
   // First, parse out rbsp, which is basically the source buffer minus emulation
   // bytes (the last byte of a 0x00 0x00 0x03 sequence). RBSP is defined in
@@ skipping 120 matching lines @@
   // weighted_pred_flag: u(1)
   uint32_t weighted_pred_flag;
   RETURN_EMPTY_ON_FAIL(bit_buffer->ReadBits(&weighted_pred_flag, 1));
   pps.weighted_pred_flag = weighted_pred_flag != 0;
   // weighted_bipred_idc: u(2)
   RETURN_EMPTY_ON_FAIL(bit_buffer->ReadBits(&pps.weighted_bipred_idc, 2));
 
   // pic_init_qp_minus26: se(v)
   RETURN_EMPTY_ON_FAIL(
       bit_buffer->ReadSignedExponentialGolomb(&pps.pic_init_qp_minus26));
+  // Sanity-check parsed value
+  if (pps.pic_init_qp_minus26 > kMaxPicInitQpDeltaValue ||
+      pps.pic_init_qp_minus26 < kMinPicInitQpDeltaValue) {
+    RETURN_EMPTY_ON_FAIL(false);
+  }
   // pic_init_qs_minus26: se(v)
   RETURN_EMPTY_ON_FAIL(bit_buffer->ReadExponentialGolomb(&golomb_ignored));
   // chroma_qp_index_offset: se(v)
   RETURN_EMPTY_ON_FAIL(bit_buffer->ReadExponentialGolomb(&golomb_ignored));
   // deblocking_filter_control_present_flag: u(1)
   // constrained_intra_pred_flag: u(1)
   RETURN_EMPTY_ON_FAIL(bit_buffer->ReadBits(&bits_tmp, 2));
   // redundant_pic_cnt_present_flag: u(1)
   RETURN_EMPTY_ON_FAIL(
       bit_buffer->ReadBits(&pps.redundant_pic_cnt_present_flag, 1));
 
   return rtc::Optional<PpsParser::PpsState>(pps);
 }
 
 bool PpsParser::ParsePpsIdsInternal(rtc::BitBuffer* bit_buffer,
                                     uint32_t* pps_id,
                                     uint32_t* sps_id) {
   // pic_parameter_set_id: ue(v)
   if (!bit_buffer->ReadExponentialGolomb(pps_id))
     return false;
   // seq_parameter_set_id: ue(v)
   if (!bit_buffer->ReadExponentialGolomb(sps_id))
     return false;
   return true;
 }
 
 }  // namespace webrtc