commit 46fc1f0b3c0cb2a4bbed0276603619431a4811ae
author Tom Finegan <tomfinegan@google.com> Wed May 16 10:34:25 2018 -0700
committer Tom Finegan <tomfinegan@google.com> Wed May 16 22:51:14 2018 +0000
tree 60480a947c7d29004bf00c3a18ca35d9103fd562
parent 5749869048c042e72f295faffd88705a4e16837d

Disallow LEB128 encode of values greater than UINT32_MAX.

Change-Id: I06f06fd85dfffe005f6dec5f3d2c79ffc76f1188

aom/src/aom_integer.c

diff --git a/aom/src/aom_integer.c b/aom/src/aom_integer.c
index ab7d125..bca9c54 100644
--- a/aom/src/aom_integer.c
+++ b/aom/src/aom_integer.c
@@ -53,6 +53,11 @@
 
 int aom_uleb_encode(uint64_t value, size_t available, uint8_t *coded_value,
                     size_t *coded_size) {
+  // Fail on values larger than 32-bits to ensure consistent behavior on
+  // 32 and 64 bit targets: value is typically used to determine buffer
+  // allocation size when decoded.
+  if (value > UINT32_MAX) return -1;
+
   const size_t leb_size = aom_uleb_size_in_bytes(value);
   if (value > kMaximumLeb128Value || leb_size > kMaximumLeb128Size ||
       leb_size > available || !coded_value || !coded_size) {

test/aom_integer_test.cc

diff --git a/test/aom_integer_test.cc b/test/aom_integer_test.cc
index 948778b..0c410a0 100644
--- a/test/aom_integer_test.cc
+++ b/test/aom_integer_test.cc
@@ -15,8 +15,8 @@
 
 namespace {
 const uint64_t kMaximumLeb128CodedSize = 8;
-const uint8_t kLeb128PadByte = 0x80;                    // Binary: 10000000
-const uint64_t kMaximumLeb128Value = 0xFFFFFFFFFFFFFF;  // 2 ^ 56 - 1
+const uint8_t kLeb128PadByte = 0x80;  // Binary: 10000000
+const uint64_t kMaximumLeb128Value = UINT32_MAX;
 const uint32_t kSizeTestNumValues = 6;
 const uint32_t kSizeTestExpectedSizes[kSizeTestNumValues] = {
   1, 1, 2, 3, 4, 5
@@ -24,6 +24,9 @@
 const uint64_t kSizeTestInputs[kSizeTestNumValues] = {
   0, 0x7f, 0x3fff, 0x1fffff, 0xffffff, 0x10000000
 };
+
+const uint8_t kOutOfRangeLeb128Value[5] = { 0x80, 0x80, 0x80, 0x80,
+                                            0x10 };  // UINT32_MAX + 1
 }  // namespace
 
 TEST(AomLeb128, DecodeTest) {
@@ -138,15 +141,9 @@
             -1);
 
   // Test that LEB128 input that decodes to a value larger than 32-bits fails.
-  uint8_t encode_buffer[kMaximumLeb128CodedSize] = { 0 };
-  const uint64_t kTooLargeForDecode = static_cast<uint64_t>(UINT32_MAX) + 1;
-  ASSERT_GT(aom_uleb_size_in_bytes(kTooLargeForDecode), 4u);
-  size_t bytes_written = 0;
-  ASSERT_EQ(aom_uleb_encode(kTooLargeForDecode, kMaximumLeb128CodedSize,
-                            &encode_buffer[0], &bytes_written),
-            0);
   size_t value_size = 0;
-  ASSERT_EQ(aom_uleb_decode(&encode_buffer[0], bytes_written, &decoded_value,
+  ASSERT_EQ(aom_uleb_decode(&kOutOfRangeLeb128Value[0],
+                            sizeof(kOutOfRangeLeb128Value), &decoded_value,
                             &value_size),
             -1);
 }