op_parameters: Use unsigned_literal for read/write decoder_buffer_delay and encoder_buffer_delay are read / written using 'encoder_decoder_buffer_delay_length' bits. And 'encoder_decoder_buffer_delay_length' is read from bitstream as a 5-bit value + 1. So, it has a range of 1 to 32. So, as the max number of bits for reading/writing decoder_buffer_delay and encoder_buffer_delay are 32, we should be using aom_rb_read_unsigned_literal() ind aom_wb_write_unsigned_literal() functions, which support max 'bits' value of 32. BUG=oss-fuzz:9126 Change-Id: I3896259f79613f5b82bda431756086dc9fea773e
diff --git a/av1/common/timing.h b/av1/common/timing.h index d31f4b7..2562951 100644 --- a/av1/common/timing.h +++ b/av1/common/timing.h
@@ -35,8 +35,8 @@ int decoder_model_param_present_flag; int64_t bitrate; int64_t buffer_size; - int decoder_buffer_delay; - int encoder_buffer_delay; + uint32_t decoder_buffer_delay; + uint32_t encoder_buffer_delay; int low_delay_mode_flag; int display_model_param_present_flag; int initial_display_delay;
diff --git a/av1/decoder/decodeframe.c b/av1/decoder/decodeframe.c index c40e2cb..5f29707 100644 --- a/av1/decoder/decodeframe.c +++ b/av1/decoder/decodeframe.c
@@ -3389,10 +3389,10 @@ op_num + 1); } - cm->op_params[op_num].decoder_buffer_delay = aom_rb_read_literal( + cm->op_params[op_num].decoder_buffer_delay = aom_rb_read_unsigned_literal( rb, cm->buffer_model.encoder_decoder_buffer_delay_length); - cm->op_params[op_num].encoder_buffer_delay = aom_rb_read_literal( + cm->op_params[op_num].encoder_buffer_delay = aom_rb_read_unsigned_literal( rb, cm->buffer_model.encoder_decoder_buffer_delay_length); cm->op_params[op_num].low_delay_mode_flag = aom_rb_read_bit(rb);
diff --git a/av1/encoder/bitstream.c b/av1/encoder/bitstream.c index 2caf0f5..4435909 100644 --- a/av1/encoder/bitstream.c +++ b/av1/encoder/bitstream.c
@@ -2533,11 +2533,13 @@ // aom_wb_write_bit(wb, cm->op_params[op_num].has_parameters); // if (!cm->op_params[op_num].has_parameters) return; - aom_wb_write_literal(wb, cm->op_params[op_num].decoder_buffer_delay, - cm->buffer_model.encoder_decoder_buffer_delay_length); + aom_wb_write_unsigned_literal( + wb, cm->op_params[op_num].decoder_buffer_delay, + cm->buffer_model.encoder_decoder_buffer_delay_length); - aom_wb_write_literal(wb, cm->op_params[op_num].encoder_buffer_delay, - cm->buffer_model.encoder_decoder_buffer_delay_length); + aom_wb_write_unsigned_literal( + wb, cm->op_params[op_num].encoder_buffer_delay, + cm->buffer_model.encoder_decoder_buffer_delay_length); aom_wb_write_bit(wb, cm->op_params[op_num].low_delay_mode_flag);