admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add more VP9 header correctness check in RtpFrameReferenceFinder

Browse Source 
Bug: chromium:1049129
Change-Id: I133673d86aadd6a87b3420a04bbf45ed53841a96
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/168240
Reviewed-by: Philip Eliasson <philipel@webrtc.org>
Commit-Queue: Ilya Nikolaevskiy <ilnik@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#30466}
This commit is contained in:
Ilya Nikolaevskiy 2020-02-05 18:01:31 +01:00 committed by Commit Bot
parent e331a122aa
commit ef0d76ae83
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
modules/video_coding/rtp_frame_reference_finder.cc
View File

@ -435,7 +435,8 @@ RtpFrameReferenceFinder::FrameDecision RtpFrameReferenceFinder::ManageFrameVp9(
}
// Protect against corrupted packets with arbitrary large temporal idx.
if (codec_header.temporal_idx >= kMaxTemporalLayers)
if (codec_header.temporal_idx >= kMaxTemporalLayers ||
codec_header.spatial_idx >= kMaxSpatialLayers)
return kDrop;
frame->id.spatial_layer = codec_header.spatial_idx;
@ -477,6 +478,12 @@ RtpFrameReferenceFinder::FrameDecision RtpFrameReferenceFinder::ManageFrameVp9(
return kDrop;
}
for (size_t i = 0; i < codec_header.gof.num_frames_in_gof; ++i) {
if (codec_header.gof.num_ref_pics[i] > kMaxVp9RefPics) {
return kDrop;
}
}
GofInfoVP9 gof = codec_header.gof;
if (gof.num_frames_in_gof == 0) {
RTC_LOG(LS_WARNING) << "Number of frames in GOF is zero. Assume "