Check trailing bits in padding OBUs.
This relands commit d1d392304f6c912b724571e219ff3882afa399d5, which was
reverted in commit 23494ddb7794c9b68ffb765c741b2670d5a66c72.
The test vectors that had padding OBUs with all zero bytes in the
payload have been fixed.
BUG=aomedia:1904
Change-Id: I72b64fd5a311182344258795804b7736befbd3b9
diff --git a/av1/decoder/obu.c b/av1/decoder/obu.c
index 3619264..c725db1 100644
--- a/av1/decoder/obu.c
+++ b/av1/decoder/obu.c
@@ -742,6 +742,24 @@
return type_length + (rb.bit_offset >> 3);
}
+// On success, returns 'sz'. On failure, sets pbi->common.error.error_code and
+// returns 0.
+static size_t read_padding(AV1_COMMON *const cm, const uint8_t *data,
+ size_t sz) {
+ // The spec allows a padding OBU to be header-only (i.e., obu_size = 0). So
+ // check trailing bits only if sz > 0.
+ if (sz > 0) {
+ // The payload of a padding OBU is byte aligned. Therefore the first
+ // trailing byte should be 0x80. See https://crbug.com/aomedia/2393.
+ const uint8_t last_nonzero_byte = get_last_nonzero_byte(data, sz);
+ if (last_nonzero_byte != 0x80) {
+ cm->error.error_code = AOM_CODEC_CORRUPT_FRAME;
+ return 0;
+ }
+ }
+ return sz;
+}
+
// On success, returns a boolean that indicates whether the decoding of the
// current frame is finished. On failure, sets cm->error.error_code and
// returns -1.
@@ -939,8 +957,8 @@
if (cm->error.error_code != AOM_CODEC_OK) return -1;
break;
case OBU_PADDING:
- // TODO(wtc): Check trailing bits.
- decoded_payload_size = payload_size;
+ decoded_payload_size = read_padding(&pbi->common, data, payload_size);
+ if (cm->error.error_code != AOM_CODEC_OK) return -1;
break;
default:
// Skip unrecognized OBUs
