}
}
+ if (k >= FF_ARRAY_ELEMS(rps->used)) {
+ av_log(avctx, AV_LOG_ERROR,
+ "Invalid num_delta_pocs: %d\n", k);
+ return AVERROR_INVALIDDATA;
+ }
+
rps->num_delta_pocs = k;
rps->num_negative_pics = k0;
// sort in increasing order (smallest first)
* which should already be in the arrays. */
if (delta) {
// Copy from previous array.
+ delta *= (size_id == 3) ? 3 : 1;
if (matrix_id < delta) {
av_log(avctx, AV_LOG_ERROR,
"Invalid delta in scaling list data: %d.\n", delta);
ff_hevc_diag_scan8x8_x[i];
scaling_list_delta_coef = get_se_golomb(gb);
- next_coef = (next_coef + scaling_list_delta_coef + 256) % 256;
+ next_coef = (next_coef + 256U + scaling_list_delta_coef) % 256;
sl->sl[size_id][matrix_id][pos] = next_coef;
}
}
int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id,
int apply_defdispwin, AVBufferRef **vps_list, AVCodecContext *avctx)
{
+ HEVCWindow *ow;
int ret = 0;
int log2_diff_max_min_transform_block_size;
int bit_depth_chroma, start, vui_present, sublayer_ordering_info;
sps->temporal_layer[i].max_dec_pic_buffering = get_ue_golomb_long(gb) + 1;
sps->temporal_layer[i].num_reorder_pics = get_ue_golomb_long(gb);
sps->temporal_layer[i].max_latency_increase = get_ue_golomb_long(gb) - 1;
- if (sps->temporal_layer[i].max_dec_pic_buffering > HEVC_MAX_DPB_SIZE) {
+ if (sps->temporal_layer[i].max_dec_pic_buffering > (unsigned)HEVC_MAX_DPB_SIZE) {
av_log(avctx, AV_LOG_ERROR, "sps_max_dec_pic_buffering_minus1 out of range: %d\n",
- sps->temporal_layer[i].max_dec_pic_buffering - 1);
+ sps->temporal_layer[i].max_dec_pic_buffering - 1U);
return AVERROR_INVALIDDATA;
}
if (sps->temporal_layer[i].num_reorder_pics > sps->temporal_layer[i].max_dec_pic_buffering - 1) {
sps->output_window.top_offset += sps->vui.def_disp_win.top_offset;
sps->output_window.bottom_offset += sps->vui.def_disp_win.bottom_offset;
}
- if (sps->output_window.left_offset & (0x1F >> (sps->pixel_shift)) &&
- !(avctx->flags & AV_CODEC_FLAG_UNALIGNED)) {
- sps->output_window.left_offset &= ~(0x1F >> (sps->pixel_shift));
- av_log(avctx, AV_LOG_WARNING, "Reducing left output window to %d "
- "chroma samples to preserve alignment.\n",
- sps->output_window.left_offset);
- }
- sps->output_width = sps->width -
- (sps->output_window.left_offset + sps->output_window.right_offset);
- sps->output_height = sps->height -
- (sps->output_window.top_offset + sps->output_window.bottom_offset);
- if (sps->width <= sps->output_window.left_offset + (int64_t)sps->output_window.right_offset ||
- sps->height <= sps->output_window.top_offset + (int64_t)sps->output_window.bottom_offset) {
- av_log(avctx, AV_LOG_WARNING, "Invalid visible frame dimensions: %dx%d.\n",
- sps->output_width, sps->output_height);
+
+ ow = &sps->output_window;
+ if (ow->left_offset >= INT_MAX - ow->right_offset ||
+ ow->top_offset >= INT_MAX - ow->bottom_offset ||
+ ow->left_offset + ow->right_offset >= sps->width ||
+ ow->top_offset + ow->bottom_offset >= sps->height) {
+ av_log(avctx, AV_LOG_WARNING, "Invalid cropping offsets: %u/%u/%u/%u\n",
+ ow->left_offset, ow->right_offset, ow->top_offset, ow->bottom_offset);
if (avctx->err_recognition & AV_EF_EXPLODE) {
return AVERROR_INVALIDDATA;
}
av_log(avctx, AV_LOG_WARNING,
"Displaying the whole video surface.\n");
+ memset(ow, 0, sizeof(*ow));
memset(&sps->pic_conf_win, 0, sizeof(sps->pic_conf_win));
- memset(&sps->output_window, 0, sizeof(sps->output_window));
- sps->output_width = sps->width;
- sps->output_height = sps->height;
}
// Inferred parameters
"Parsed SPS: id %d; coded wxh: %dx%d; "
"cropped wxh: %dx%d; pix_fmt: %s.\n",
sps_id, sps->width, sps->height,
- sps->output_width, sps->output_height,
+ sps->width - (sps->output_window.left_offset + sps->output_window.right_offset),
+ sps->height - (sps->output_window.top_offset + sps->output_window.bottom_offset),
av_get_pix_fmt_name(sps->pix_fmt));
}