commit 0cbcf79819ec17344335ec93c1a40994483088eb
author Thomas Davies <thdavies@cisco.com> Thu Mar 15 14:10:02 2018 +0000
committer Yaowu Xu <yaowu@google.com> Sat Mar 17 22:11:27 2018 +0000
tree 03c5bdc3b4c1df1c6d3c1e7041a2ec93eb15f058
parent 320449146a377f81f3aaec10003cd38fba317e69

[NORMATIVE] Enforce constraint on frame_id_length.

frame_id_length can be at most 16 bits.

Although this is a normative change, it does not change
encoded bitstreams using the frame buffer marking feature.

BUG=aomedia:1578

Change-Id: I602bc5de57a3768d1955f2e3dad3bccc0ed95e74

av1/decoder/decodeframe.c

diff --git a/av1/decoder/decodeframe.c b/av1/decoder/decodeframe.c
index 7488710..bf96f8a 100644
--- a/av1/decoder/decodeframe.c
+++ b/av1/decoder/decodeframe.c
@@ -2373,8 +2373,8 @@
   }
 }
 
-void read_sequence_header(SequenceHeader *seq_params,
-                          struct aom_read_bit_buffer *rb) {
+void read_sequence_header(AV1_COMMON *cm, struct aom_read_bit_buffer *rb) {
+  SequenceHeader *seq_params = &cm->seq_params;
   int num_bits_width = aom_rb_read_literal(rb, 4) + 1;
   int num_bits_height = aom_rb_read_literal(rb, 4) + 1;
   int max_frame_width = aom_rb_read_literal(rb, num_bits_width) + 1;
@@ -2393,6 +2393,9 @@
     seq_params->delta_frame_id_length = aom_rb_read_literal(rb, 4) + 2;
     seq_params->frame_id_length =
         aom_rb_read_literal(rb, 3) + seq_params->delta_frame_id_length + 1;
+    if (seq_params->frame_id_length > 16)
+      aom_internal_error(&cm->error, AOM_CODEC_CORRUPT_FRAME,
+                         "Invalid frame_id_length");
   }
 
   setup_sb_size(seq_params, rb);