Sanity check parsed QP values from H264 bitstream

webrtc/common_video/h264/pps_parser.cc

Index: webrtc/common_video/h264/pps_parser.cc
diff --git a/webrtc/common_video/h264/pps_parser.cc b/webrtc/common_video/h264/pps_parser.cc
index 0215549959e39be2d224090539f29938c096a486..fd1cb0db471e64f991fb9edda11fa615e7eae6a5 100644
--- a/webrtc/common_video/h264/pps_parser.cc
+++ b/webrtc/common_video/h264/pps_parser.cc
@@ -22,6 +22,10 @@
     return rtc::Optional<PpsParser::PpsState>(); \
   }
 
+namespace {
+const int kMaxAbsPicInitQpDeltaValue = 25;
+}
+
 namespace webrtc {
 
 // General note: this is based off the 02/2014 version of the H.264 standard.
@@ -162,6 +166,10 @@ rtc::Optional<PpsParser::PpsState> PpsParser::ParseInternal(
   // pic_init_qp_minus26: se(v)
   RETURN_EMPTY_ON_FAIL(
       bit_buffer->ReadSignedExponentialGolomb(&pps.pic_init_qp_minus26));
+  // Sanity-check parsed value
+  if (abs(pps.pic_init_qp_minus26) > kMaxAbsPicInitQpDeltaValue) {

[pbos-webrtc, 2016/11/29 15:31:50]

"The value of pic_init_qp_minus26 shall be in the range of
−(26 + QpBdOffsetY ) to +25, inclusive."

Assuming that QpBdOffsety is 0, which I think it should be given I420 (I don't
like reading this standard at all).

So < -26 or > 25 seems to be the correct check if we assume I420. Not sure where
that offset is parsed otherwise.

+    RETURN_EMPTY_ON_FAIL(false);
+  }
   // pic_init_qs_minus26: se(v)
   RETURN_EMPTY_ON_FAIL(bit_buffer->ReadExponentialGolomb(&golomb_ignored));
   // chroma_qp_index_offset: se(v)