Commit 70ba8cdc authored by michael's avatar michael

Get rid of now unneeded pps/sps correctness code as pps/sps will not

be used at all when anything fails sanity checks.


git-svn-id: file:///var/local/repositories/ffmpeg/trunk@15972 9553f0bf-9b14-0410-a0b8-cfaf0461ba5b
parent edd93d0b
...@@ -6913,21 +6913,18 @@ static inline int decode_vui_parameters(H264Context *h, SPS *sps){ ...@@ -6913,21 +6913,18 @@ static inline int decode_vui_parameters(H264Context *h, SPS *sps){
sps->bitstream_restriction_flag = get_bits1(&s->gb); sps->bitstream_restriction_flag = get_bits1(&s->gb);
if(sps->bitstream_restriction_flag){ if(sps->bitstream_restriction_flag){
unsigned int num_reorder_frames;
get_bits1(&s->gb); /* motion_vectors_over_pic_boundaries_flag */ get_bits1(&s->gb); /* motion_vectors_over_pic_boundaries_flag */
get_ue_golomb(&s->gb); /* max_bytes_per_pic_denom */ get_ue_golomb(&s->gb); /* max_bytes_per_pic_denom */
get_ue_golomb(&s->gb); /* max_bits_per_mb_denom */ get_ue_golomb(&s->gb); /* max_bits_per_mb_denom */
get_ue_golomb(&s->gb); /* log2_max_mv_length_horizontal */ get_ue_golomb(&s->gb); /* log2_max_mv_length_horizontal */
get_ue_golomb(&s->gb); /* log2_max_mv_length_vertical */ get_ue_golomb(&s->gb); /* log2_max_mv_length_vertical */
num_reorder_frames= get_ue_golomb(&s->gb); sps->num_reorder_frames= get_ue_golomb(&s->gb);
get_ue_golomb(&s->gb); /*max_dec_frame_buffering*/ get_ue_golomb(&s->gb); /*max_dec_frame_buffering*/
if(num_reorder_frames > 16 /*max_dec_frame_buffering || max_dec_frame_buffering > 16*/){ if(sps->num_reorder_frames > 16U /*max_dec_frame_buffering || max_dec_frame_buffering > 16*/){
av_log(h->s.avctx, AV_LOG_ERROR, "illegal num_reorder_frames %d\n", num_reorder_frames); av_log(h->s.avctx, AV_LOG_ERROR, "illegal num_reorder_frames %d\n", sps->num_reorder_frames);
return -1; return -1;
} }
sps->num_reorder_frames= num_reorder_frames;
} }
return 0; return 0;
...@@ -6980,7 +6977,7 @@ static void decode_scaling_matrices(H264Context *h, SPS *sps, PPS *pps, int is_s ...@@ -6980,7 +6977,7 @@ static void decode_scaling_matrices(H264Context *h, SPS *sps, PPS *pps, int is_s
static inline int decode_seq_parameter_set(H264Context *h){ static inline int decode_seq_parameter_set(H264Context *h){
MpegEncContext * const s = &h->s; MpegEncContext * const s = &h->s;
int profile_idc, level_idc; int profile_idc, level_idc;
unsigned int sps_id, tmp, mb_width, mb_height; unsigned int sps_id;
int i; int i;
SPS *sps; SPS *sps;
...@@ -7029,13 +7026,12 @@ static inline int decode_seq_parameter_set(H264Context *h){ ...@@ -7029,13 +7026,12 @@ static inline int decode_seq_parameter_set(H264Context *h){
sps->delta_pic_order_always_zero_flag= get_bits1(&s->gb); sps->delta_pic_order_always_zero_flag= get_bits1(&s->gb);
sps->offset_for_non_ref_pic= get_se_golomb(&s->gb); sps->offset_for_non_ref_pic= get_se_golomb(&s->gb);
sps->offset_for_top_to_bottom_field= get_se_golomb(&s->gb); sps->offset_for_top_to_bottom_field= get_se_golomb(&s->gb);
tmp= get_ue_golomb(&s->gb); sps->poc_cycle_length = get_ue_golomb(&s->gb);
if(tmp >= FF_ARRAY_ELEMS(sps->offset_for_ref_frame)){ if((unsigned)sps->poc_cycle_length >= FF_ARRAY_ELEMS(sps->offset_for_ref_frame)){
av_log(h->s.avctx, AV_LOG_ERROR, "poc_cycle_length overflow %u\n", tmp); av_log(h->s.avctx, AV_LOG_ERROR, "poc_cycle_length overflow %u\n", sps->poc_cycle_length);
goto fail; goto fail;
} }
sps->poc_cycle_length= tmp;
for(i=0; i<sps->poc_cycle_length; i++) for(i=0; i<sps->poc_cycle_length; i++)
sps->offset_for_ref_frame[i]= get_se_golomb(&s->gb); sps->offset_for_ref_frame[i]= get_se_golomb(&s->gb);
...@@ -7044,22 +7040,19 @@ static inline int decode_seq_parameter_set(H264Context *h){ ...@@ -7044,22 +7040,19 @@ static inline int decode_seq_parameter_set(H264Context *h){
goto fail; goto fail;
} }
tmp= get_ue_golomb(&s->gb); sps->ref_frame_count= get_ue_golomb(&s->gb);
if(tmp > MAX_PICTURE_COUNT-2 || tmp >= 32){ if(sps->ref_frame_count > MAX_PICTURE_COUNT-2 || sps->ref_frame_count >= 32U){
av_log(h->s.avctx, AV_LOG_ERROR, "too many reference frames\n"); av_log(h->s.avctx, AV_LOG_ERROR, "too many reference frames\n");
goto fail; goto fail;
} }
sps->ref_frame_count= tmp;
sps->gaps_in_frame_num_allowed_flag= get_bits1(&s->gb); sps->gaps_in_frame_num_allowed_flag= get_bits1(&s->gb);
mb_width= get_ue_golomb(&s->gb) + 1; sps->mb_width = get_ue_golomb(&s->gb) + 1;
mb_height= get_ue_golomb(&s->gb) + 1; sps->mb_height= get_ue_golomb(&s->gb) + 1;
if(mb_width >= INT_MAX/16 || mb_height >= INT_MAX/16 || if((unsigned)sps->mb_width >= INT_MAX/16 || (unsigned)sps->mb_height >= INT_MAX/16 ||
avcodec_check_dimensions(NULL, 16*mb_width, 16*mb_height)){ avcodec_check_dimensions(NULL, 16*sps->mb_width, 16*sps->mb_height)){
av_log(h->s.avctx, AV_LOG_ERROR, "mb_width/height overflow\n"); av_log(h->s.avctx, AV_LOG_ERROR, "mb_width/height overflow\n");
goto fail; goto fail;
} }
sps->mb_width = mb_width;
sps->mb_height= mb_height;
sps->frame_mbs_only_flag= get_bits1(&s->gb); sps->frame_mbs_only_flag= get_bits1(&s->gb);
if(!sps->frame_mbs_only_flag) if(!sps->frame_mbs_only_flag)
...@@ -7128,7 +7121,7 @@ build_qp_table(PPS *pps, int t, int index) ...@@ -7128,7 +7121,7 @@ build_qp_table(PPS *pps, int t, int index)
static inline int decode_picture_parameter_set(H264Context *h, int bit_length){ static inline int decode_picture_parameter_set(H264Context *h, int bit_length){
MpegEncContext * const s = &h->s; MpegEncContext * const s = &h->s;
unsigned int tmp, pps_id= get_ue_golomb(&s->gb); unsigned int pps_id= get_ue_golomb(&s->gb);
PPS *pps; PPS *pps;
if(pps_id >= MAX_PPS_COUNT) { if(pps_id >= MAX_PPS_COUNT) {
...@@ -7136,15 +7129,14 @@ static inline int decode_picture_parameter_set(H264Context *h, int bit_length){ ...@@ -7136,15 +7129,14 @@ static inline int decode_picture_parameter_set(H264Context *h, int bit_length){
return -1; return -1;
} }
tmp= get_ue_golomb(&s->gb);
if(tmp>=MAX_SPS_COUNT || h->sps_buffers[tmp] == NULL){
av_log(h->s.avctx, AV_LOG_ERROR, "sps_id out of range\n");
return -1;
}
pps= av_mallocz(sizeof(PPS)); pps= av_mallocz(sizeof(PPS));
if(pps == NULL) if(pps == NULL)
return -1; return -1;
pps->sps_id= tmp; pps->sps_id= get_ue_golomb(&s->gb);
if((unsigned)pps->sps_id>=MAX_SPS_COUNT || h->sps_buffers[pps->sps_id] == NULL){
av_log(h->s.avctx, AV_LOG_ERROR, "sps_id out of range\n");
goto fail;
}
pps->cabac= get_bits1(&s->gb); pps->cabac= get_bits1(&s->gb);
pps->pic_order_present= get_bits1(&s->gb); pps->pic_order_present= get_bits1(&s->gb);
...@@ -7190,7 +7182,6 @@ static inline int decode_picture_parameter_set(H264Context *h, int bit_length){ ...@@ -7190,7 +7182,6 @@ static inline int decode_picture_parameter_set(H264Context *h, int bit_length){
pps->ref_count[1]= get_ue_golomb(&s->gb) + 1; pps->ref_count[1]= get_ue_golomb(&s->gb) + 1;
if(pps->ref_count[0]-1 > 32-1 || pps->ref_count[1]-1 > 32-1){ if(pps->ref_count[0]-1 > 32-1 || pps->ref_count[1]-1 > 32-1){
av_log(h->s.avctx, AV_LOG_ERROR, "reference overflow (pps)\n"); av_log(h->s.avctx, AV_LOG_ERROR, "reference overflow (pps)\n");
pps->ref_count[0]= pps->ref_count[1]= 1;
goto fail; goto fail;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment