Eyevinn / hi264 / 37934260481

88%

main: 88%

Pull #37

github

fix: reject an out-of-range mb_qp_delta

The CAVLC decoder took the se(v) value of mb_qp_delta without a range check. A large negative value makes the dividend of equation 7-37 negative, Go's % keeps the sign, and the negative QPY then indexes the dequantisation tables with qp%6 < 0 and panics. This was reachable from DecodeNALUs on untrusted input.

Both entropy coders now go through SliceContext.applyQPDelta, which rejects an mb_qp_delta outside -(26 + QpBdOffsetY/2)..+(25 + QpBdOffsetY/2) (section 7.4.5) before the QPY update. mp4ff already keeps SliceQPY in -QpBdOffsetY..51, so an in-range mb_qp_delta keeps the wrap non-negative. The check also closes the CABAC gap where the unary-length bound from #33 still let +26 through (harmless there). qpDeltaMaxUnary is now derived from the new qpDeltaRange.

The fuzz input from the issue is added to the corpus. Since the multi-slice change (#36) that input is rejected earlier (the slice runs past the last macroblock), so TestDecodeRejectsOutOfRangeQPDelta builds a one-macroblock CAVLC slice with the boundary values and with -100, which panics without this fix. deblockOffsetStream becomes oneMBStream to take mb_qp_delta.

Closes #35

21 of 23 new or added lines in 2 files covered. (91.3%)

8747 of 9911 relevant lines covered (88.26%)

1.02 hits per line