Backport compliance check from dav1d 1.2.1 (#365)

obu: validate some timing values
memorysafety · Aug 9, 2023 · ca04ed6 · ca04ed6
2 parents 5e12886 + 0893ca4
commit ca04ed6
Show file tree

Hide file tree

Showing 2 changed files with 36 additions and 18 deletions.
diff --git a/src/obu.c b/src/obu.c
@@ -79,6 +79,8 @@ static int parse_seq_hdr(Dav1dContext *const c, GetBits *const gb,
         if (hdr->timing_info_present) {
             hdr->num_units_in_tick = dav1d_get_bits(gb, 32);
             hdr->time_scale = dav1d_get_bits(gb, 32);
+            if (c->strict_std_compliance && (!hdr->num_units_in_tick || !hdr->time_scale))
+                goto error;
             hdr->equal_picture_interval = dav1d_get_bit(gb);
             if (hdr->equal_picture_interval) {
                 const unsigned num_ticks_per_picture = dav1d_get_vlc(gb);
@@ -91,6 +93,8 @@ static int parse_seq_hdr(Dav1dContext *const c, GetBits *const gb,
             if (hdr->decoder_model_info_present) {
                 hdr->encoder_decoder_buffer_delay_length = dav1d_get_bits(gb, 5) + 1;
                 hdr->num_units_in_decoding_tick = dav1d_get_bits(gb, 32);
+                if (c->strict_std_compliance && !hdr->num_units_in_decoding_tick)
+                    goto error;
                 hdr->buffer_removal_delay_length = dav1d_get_bits(gb, 5) + 1;
                 hdr->frame_presentation_delay_length = dav1d_get_bits(gb, 5) + 1;
             }

diff --git a/src/obu.rs b/src/obu.rs
@@ -729,18 +729,24 @@ unsafe extern "C" fn parse_seq_hdr(
                 if (*hdr).timing_info_present != 0 {
                     (*hdr).num_units_in_tick = dav1d_get_bits(gb, 32 as libc::c_int) as libc::c_int;
                     (*hdr).time_scale = dav1d_get_bits(gb, 32 as libc::c_int) as libc::c_int;
-                    (*hdr).equal_picture_interval = dav1d_get_bit(gb) as libc::c_int;
-                    if (*hdr).equal_picture_interval != 0 {
-                        let num_ticks_per_picture: libc::c_uint = dav1d_get_vlc(gb);
-                        if num_ticks_per_picture == 0xffffffff as libc::c_uint {
-                            current_block = 181392771181400725;
+                    if (*c).strict_std_compliance != 0
+                        && ((*hdr).num_units_in_tick == 0 || (*hdr).time_scale == 0)
+                    {
+                        current_block = 181392771181400725;
+                    } else {
+                        (*hdr).equal_picture_interval = dav1d_get_bit(gb) as libc::c_int;
+                        if (*hdr).equal_picture_interval != 0 {
+                            let num_ticks_per_picture: libc::c_uint = dav1d_get_vlc(gb);
+                            if num_ticks_per_picture == 0xffffffff as libc::c_uint {
+                                current_block = 181392771181400725;
+                            } else {
+                                (*hdr).num_ticks_per_picture = num_ticks_per_picture
+                                    .wrapping_add(1 as libc::c_int as libc::c_uint);
+                                current_block = 10048703153582371463;
+                            }
                         } else {
-                            (*hdr).num_ticks_per_picture = num_ticks_per_picture
-                                .wrapping_add(1 as libc::c_int as libc::c_uint);
                             current_block = 10048703153582371463;
                         }
-                    } else {
-                        current_block = 10048703153582371463;
                     }
                     match current_block {
                         181392771181400725 => {}
@@ -753,16 +759,24 @@ unsafe extern "C" fn parse_seq_hdr(
                                         as libc::c_int;
                                 (*hdr).num_units_in_decoding_tick =
                                     dav1d_get_bits(gb, 32 as libc::c_int) as libc::c_int;
-                                (*hdr).buffer_removal_delay_length =
-                                    (dav1d_get_bits(gb, 5 as libc::c_int))
-                                        .wrapping_add(1 as libc::c_int as libc::c_uint)
-                                        as libc::c_int;
-                                (*hdr).frame_presentation_delay_length =
-                                    (dav1d_get_bits(gb, 5 as libc::c_int))
-                                        .wrapping_add(1 as libc::c_int as libc::c_uint)
-                                        as libc::c_int;
+                                if (*c).strict_std_compliance != 0
+                                    && (*hdr).num_units_in_decoding_tick == 0
+                                {
+                                    current_block = 181392771181400725;
+                                } else {
+                                    (*hdr).buffer_removal_delay_length =
+                                        (dav1d_get_bits(gb, 5 as libc::c_int))
+                                            .wrapping_add(1 as libc::c_int as libc::c_uint)
+                                            as libc::c_int;
+                                    (*hdr).frame_presentation_delay_length =
+                                        (dav1d_get_bits(gb, 5 as libc::c_int))
+                                            .wrapping_add(1 as libc::c_int as libc::c_uint)
+                                            as libc::c_int;
+                                    current_block = 4808432441040389987;
+                                }
+                            } else {
+                                current_block = 4808432441040389987;
                             }
-                            current_block = 4808432441040389987;
                         }
                     }
                 } else {