Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2f4555e2 authored by Lajos Molnar's avatar Lajos Molnar
Browse files

stagefright: add safe versions of parseUE and parseSE

Bug: 28938657
Change-Id: If3d6c8fda14a0f9d9ab7dc6fced530dfb5d51113
parent 5c8f37fd
Loading
Loading
Loading
Loading
+27 −0
Original line number Diff line number Diff line
@@ -41,12 +41,39 @@ unsigned parseUE(ABitReader *br) {
    return x + (1u << numZeroes) - 1;
}

unsigned parseUEWithFallback(ABitReader *br, unsigned fallback) {
    unsigned numZeroes = 0;
    while (br->getBitsWithFallback(1, 1) == 0) {
        ++numZeroes;
    }
    uint32_t x;
    if (numZeroes < 32) {
        if (br->getBitsGraceful(numZeroes, &x)) {
            return x + (1u << numZeroes) - 1;
        } else {
            return fallback;
        }
    } else {
        br->skipBits(numZeroes);
        return fallback;
    }
}

signed parseSE(ABitReader *br) {
    unsigned codeNum = parseUE(br);

    return (codeNum & 1) ? (codeNum + 1) / 2 : -(codeNum / 2);
}

signed parseSEWithFallback(ABitReader *br, signed fallback) {
    // NOTE: parseUE cannot normally return ~0 as the max supported value is 0xFFFE
    unsigned codeNum = parseUEWithFallback(br, ~0U);
    if (codeNum == ~0U) {
        return fallback;
    }
    return (codeNum & 1) ? (codeNum + 1) / 2 : -(codeNum / 2);
}

static void skipScalingList(ABitReader *br, size_t sizeOfScalingList) {
    size_t lastScale = 8;
    size_t nextScale = 8;
+26 −0
Original line number Diff line number Diff line
@@ -47,8 +47,34 @@ void FindAVCDimensions(
        int32_t *width, int32_t *height,
        int32_t *sarWidth = NULL, int32_t *sarHeight = NULL);

// Gets and returns an unsigned exp-golomb (ue) value from a bit reader |br|. Aborts if the value
// is more than 64 bits long (>=0xFFFF (!)) or the bit reader overflows.
unsigned parseUE(ABitReader *br);

// Gets and returns a signed exp-golomb (se) value from a bit reader |br|. Aborts if the value is
// more than 64 bits long (>0x7FFF || <-0x7FFF (!)) or the bit reader overflows.
signed parseSE(ABitReader *br);

// Gets an unsigned exp-golomb (ue) value from a bit reader |br|, and returns it if it was
// successful. Returns |fallback| if it was unsuccessful. Note: if the value was longer that 64
// bits, it reads past the value and still returns |fallback|.
unsigned parseUEWithFallback(ABitReader *br, unsigned fallback);

// Gets a signed exp-golomb (se) value from a bit reader |br|, and returns it if it was successful.
// Returns |fallback| if it was unsuccessful. Note: if the value was longer that 64 bits, it reads
// past the value and still returns |fallback|.
signed parseSEWithFallback(ABitReader *br, signed fallback);

// Skips an unsigned exp-golomb (ue) value from bit reader |br|.
inline void skipUE(ABitReader *br) {
    (void)parseUEWithFallback(br, 0U);
}

// Skips a signed exp-golomb (se) value from bit reader |br|.
inline void skipSE(ABitReader *br) {
    (void)parseSEWithFallback(br, 0);
}

status_t getNextNALUnit(
        const uint8_t **_data, size_t *_size,
        const uint8_t **nalStart, size_t *nalSize,