Eyevinn / mp4ff / 36987980380

83%

push

github

fix(avc): reject out-of-range parameter set and slice header values

Fuzzing a decoder built on the avc package found inputs that make the
parsers misbehave instead of returning an error:

- ParseSliceHeader looped forever on num_ref_idx_l0_active_minus1 =
  0xFFFFFFFF with weighted prediction, since the uint32 counter of the
  pred_weight_table loop can never exceed it. Values above 31 (7.4.2.2,
  7.4.3) are now rejected in the slice header and the PPS defaults, before
  the uint32 conversion can truncate them.
- ParseSliceHeader returned a header with zeroed fields and no error for a
  NAL unit ending inside the slice header. It now returns the reader error.
- Frame cropping larger than the picture wrapped SPS.Width and SPS.Height
  around (e.g. 18446744073709551432). The offsets are now checked against
  the picture size (7.4.2.1.1) without adding them, and
  pic_width_in_mbs_minus1 and pic_height_in_map_units_minus1 are bounded by
  the largest MaxFS of any level (139264, levels 6-6.2 in Table A-1).
- Other values used as bit counts, table indices or QPs are checked against
  their spec ranges: chroma_format_idc (previously truncated to a byte),
  bit_depth_luma/chroma_minus8, log2_max_frame_num_minus4,
  log2_max_pic_order_cnt_lsb_minus4, pic_init_qp/qs_minus26,
  (second_)chroma_qp_index_offset, and SliceQPY = 26 + pic_init_qp_minus26
  + slice_qp_delta in [-QpBdOffsetY, 51]. A fuzzed slice_qp_delta of -3085
  made the decoder index its dequantization tables with a negative QP.

70 of 72 new or added lines in 3 files covered. (97.22%)

22943 of 27811 relevant lines covered (82.5%)

0.83 hits per line