aleleba/filmcraft
1
0
Fork 0
mirror of https://github.com/storytold/filmcraft.git synced 2026-10-24 10:10:05 -06:00
Code Issues Packages Projects Releases Wiki Activity

#1457: bound slice-group map type 6 by the picture's map units (CIF FMO is 396), drop pr1441.md

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Brandon Thomas
2026-10-13 01:34:27 -04:00
co-authored by Claude Opus 5.5
parent 62e94fb2dd
commit 39f60de2f4
2 changed files with 2 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/h264/src/params.rs
+2 -1
View File
@@ -594,7 +594,8 @@ impl Pps {
}
6 => {
let n_minus1 = r.read_ue()?;
ensure!(n_minus1 <= 128, "slice_group_run_length out of range");
// pic_size_in_map_units_minus1: one slice_group_id per map unit of the picture.
ensure!(n_minus1 < sps.pic_width_in_mbs.saturating_mul(sps.pic_height_in_map_units), "pic_size_in_map_units out of range");
let n = n_minus1 + 1;
let bits = 32 - (num_slice_groups - 1).leading_zeros();
for _ in 0..n {
pr1441.md
-18
View File
@@ -1,18 +0,0 @@
## What
`Pps::parse` added offsets to input-derived fields before validating them, so six malformed-PPS fields panic (overflow checks on) instead of returning `Error::Invalid`. The panic reaches the public `Decoder::decode` API. Fixes #1441.
## Changes (`crates/h264/src/params.rs`)
- **Validate before incrementing**: `num_slice_groups_minus1 < 8`, `num_ref_idx_l0/l1_default_active_minus1 < 32` are checked pre-`+1`; the map-type-6 run-length count is bounded before `+1`.
- **QP/QS range checks per 7.4.2.2**: `pic_init_qp_minus26` must be in `-(26 + QpBdOffsetY)..=25` (bit-depth aware via the SPS) and `pic_init_qs_minus26` in `-26..=25`, checked before adding 26.
- **`weighted_bipred_idc`**: concealed `3 → 2` per the 7.4.2.2.1 fall-back rule ("shall be considered equal to 2") rather than rejected — matches the spec text, and the slice decoder already only distinguishes 0/1/2.
## Tests (`crates/h264/tests/pps_validation.rs`, 6 tests)
- The reporter's literal 12-byte SPS + 18-byte PPS: `catch_unwind` now sees `Err`, not a panic.
- Synthetic bit-built PPSes for hostile `num_slice_groups`, hostile `num_ref_idx_l1`, hostile `pic_init_qp`.
- `weighted_bipred_idc = 3` parses with the field concealed to 2.
- A well-formed minimal PPS still parses (control).
Red/green verified: reporter-literal and concealment tests fail on main (panic at params.rs:604 / silent accept), all 6 pass with the fix; negative control via stash round-trip. Full `filmcraft-h264` suite green (7 test binaries, 0 failures), `cargo fmt --check` and `cargo clippy -p filmcraft-h264 --all-targets` clean.