FRAME_SIZE: Never exceed maximum frame dimensions. Encoder: Use oxcf->width/heigth instead of cm->width/height in sequence header. aom_internal_error() if cm->width/height is larger than max values. Decoder: aom_internal_error() if cm->width/height is larger than max values. Change-Id: I8d8b415efe82d961dbe34377f4da79379cb111a8
diff --git a/av1/decoder/decodeframe.c b/av1/decoder/decodeframe.c index 5a5bb9a..84e8119 100644 --- a/av1/decoder/decodeframe.c +++ b/av1/decoder/decodeframe.c
@@ -1478,6 +1478,11 @@ int num_bits_width = cm->seq_params.num_bits_width; int num_bits_height = cm->seq_params.num_bits_height; av1_read_frame_size(rb, num_bits_width, num_bits_height, &width, &height); + if (width > cm->seq_params.max_frame_width || + height > cm->seq_params.max_frame_height) { + aom_internal_error(&cm->error, AOM_CODEC_CORRUPT_FRAME, + "Frame dimensions are larger than the maximum values"); + } } else { width = cm->seq_params.max_frame_width; height = cm->seq_params.max_frame_height;
diff --git a/av1/encoder/bitstream.c b/av1/encoder/bitstream.c index 9a43666..f964d3b 100644 --- a/av1/encoder/bitstream.c +++ b/av1/encoder/bitstream.c
@@ -3503,15 +3503,15 @@ } #if CONFIG_REFERENCE_BUFFER || CONFIG_OBU -void write_sequence_header(AV1_COMMON *const cm, - struct aom_write_bit_buffer *wb) { +void write_sequence_header(AV1_COMP *cpi, struct aom_write_bit_buffer *wb) { + AV1_COMMON *const cm = &cpi->common; SequenceHeader *seq_params = &cm->seq_params; #if CONFIG_FRAME_SIZE int num_bits_width = 16; int num_bits_height = 16; - int max_frame_width = cm->width; - int max_frame_height = cm->height; + int max_frame_width = cpi->oxcf.width; + int max_frame_height = cpi->oxcf.height; seq_params->num_bits_width = num_bits_width; seq_params->num_bits_height = num_bits_height; @@ -3727,7 +3727,7 @@ if (frame_is_intra_only(cm)) { #if CONFIG_REFERENCE_BUFFER - write_sequence_header(cm, wb); + write_sequence_header(cpi, wb); #endif // CONFIG_REFERENCE_BUFFER } #if CONFIG_REFERENCE_BUFFER @@ -3739,6 +3739,11 @@ #endif // CONFIG_REFERENCE_BUFFER #if CONFIG_FRAME_SIZE + if (cm->width > cm->seq_params.max_frame_width || + cm->height > cm->seq_params.max_frame_height) { + aom_internal_error(&cm->error, AOM_CODEC_UNSUP_BITSTREAM, + "Frame dimensions are larger than the maximum values"); + } int frame_size_override_flag = (cm->width != cm->seq_params.max_frame_width || cm->height != cm->seq_params.max_frame_height); @@ -4043,6 +4048,11 @@ #endif // CONFIG_REFERENCE_BUFFER #if CONFIG_FRAME_SIZE + if (cm->width > cm->seq_params.max_frame_width || + cm->height > cm->seq_params.max_frame_height) { + aom_internal_error(&cm->error, AOM_CODEC_UNSUP_BITSTREAM, + "Frame dimensions are larger than the maximum values"); + } int frame_size_override_flag = (cm->width != cm->seq_params.max_frame_width || cm->height != cm->seq_params.max_frame_height); @@ -4628,7 +4638,7 @@ aom_wb_write_literal(&wb, 0, 4); - write_sequence_header(cm, &wb); + write_sequence_header(cpi, &wb); // color_config write_bitdepth_colorspace_sampling(cm, &wb);
diff --git a/av1/encoder/bitstream.h b/av1/encoder/bitstream.h index 0dbc488..69e0500 100644 --- a/av1/encoder/bitstream.h +++ b/av1/encoder/bitstream.h
@@ -21,8 +21,7 @@ struct aom_write_bit_buffer; #if CONFIG_REFERENCE_BUFFER -void write_sequence_header(AV1_COMMON *const cm, - struct aom_write_bit_buffer *wb); +void write_sequence_header(AV1_COMP *cpi, struct aom_write_bit_buffer *wb); #endif #if CONFIG_OBU