From 39f60de2f4ca6d73c788ee49925bb1c90a44cf55 Mon Sep 17 00:00:00 2001 From: Brandon Thomas Date: Tue, 13 Oct 2026 01:34:27 -0400 Subject: [PATCH] #1457: bound slice-group map type 6 by the picture's map units (CIF FMO is 396), drop pr1441.md Co-Authored-By: Claude Opus 5.5 --- crates/h264/src/params.rs | 3 ++- pr1441.md | 18 ------------------ 2 files changed, 2 insertions(+), 19 deletions(-) delete mode 100644 pr1441.md diff --git a/crates/h264/src/params.rs b/crates/h264/src/params.rs index dd7b4d234..5b92a6055 100644 --- a/crates/h264/src/params.rs +++ b/crates/h264/src/params.rs @@ -594,7 +594,8 @@ impl Pps { } 6 => { let n_minus1 = r.read_ue()?; - ensure!(n_minus1 <= 128, "slice_group_run_length out of range"); + // pic_size_in_map_units_minus1: one slice_group_id per map unit of the picture. + ensure!(n_minus1 < sps.pic_width_in_mbs.saturating_mul(sps.pic_height_in_map_units), "pic_size_in_map_units out of range"); let n = n_minus1 + 1; let bits = 32 - (num_slice_groups - 1).leading_zeros(); for _ in 0..n { diff --git a/pr1441.md b/pr1441.md deleted file mode 100644 index f3e0ea34d..000000000 --- a/pr1441.md +++ /dev/null @@ -1,18 +0,0 @@ -## What - -`Pps::parse` added offsets to input-derived fields before validating them, so six malformed-PPS fields panic (overflow checks on) instead of returning `Error::Invalid`. The panic reaches the public `Decoder::decode` API. Fixes #1441. - -## Changes (`crates/h264/src/params.rs`) - -- **Validate before incrementing**: `num_slice_groups_minus1 < 8`, `num_ref_idx_l0/l1_default_active_minus1 < 32` are checked pre-`+1`; the map-type-6 run-length count is bounded before `+1`. -- **QP/QS range checks per 7.4.2.2**: `pic_init_qp_minus26` must be in `-(26 + QpBdOffsetY)..=25` (bit-depth aware via the SPS) and `pic_init_qs_minus26` in `-26..=25`, checked before adding 26. -- **`weighted_bipred_idc`**: concealed `3 → 2` per the 7.4.2.2.1 fall-back rule ("shall be considered equal to 2") rather than rejected — matches the spec text, and the slice decoder already only distinguishes 0/1/2. - -## Tests (`crates/h264/tests/pps_validation.rs`, 6 tests) - -- The reporter's literal 12-byte SPS + 18-byte PPS: `catch_unwind` now sees `Err`, not a panic. -- Synthetic bit-built PPSes for hostile `num_slice_groups`, hostile `num_ref_idx_l1`, hostile `pic_init_qp`. -- `weighted_bipred_idc = 3` parses with the field concealed to 2. -- A well-formed minimal PPS still parses (control). - -Red/green verified: reporter-literal and concealment tests fail on main (panic at params.rs:604 / silent accept), all 6 pass with the fix; negative control via stash round-trip. Full `filmcraft-h264` suite green (7 test binaries, 0 failures), `cargo fmt --check` and `cargo clippy -p filmcraft-h264 --all-targets` clean.