Skip to content

Output value of avm_uleb_decode() is <= UINT32_MAX#5010

Draft
wantehchang wants to merge 1 commit into
AOMediaCodec:mainfrom
wantehchang:remove-unneeded-UINT32_MAX-check
Draft

Output value of avm_uleb_decode() is <= UINT32_MAX#5010
wantehchang wants to merge 1 commit into
AOMediaCodec:mainfrom
wantehchang:remove-unneeded-UINT32_MAX-check

Conversation

@wantehchang
Copy link
Copy Markdown
Member

If the leb128() value read from the bitstream is > UINT32_MAX, avm_uleb_decode() fails and returns -1. Therefore after a successful avm_uleb_decode() call, the output value must be <= UINT32_MAX.

If the leb128() value read from the bitstream is > UINT32_MAX,
avm_uleb_decode() fails and returns -1. Therefore after a successful
avm_uleb_decode() call, the output value must be <= UINT32_MAX.
Comment thread av2/decoder/obu.c
cm->error.error_code = AVM_CODEC_CORRUPT_FRAME;
return 0;
}
assert(type_value <= UINT32_MAX);
Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The following code in avm_uleb_decode() ensures that type_value <= UINT32_MAX:

int avm_uleb_decode(const uint8_t *buffer, size_t available, uint64_t *value,
                    size_t *length) {
        ...

        // Fail on values larger than 32-bits to ensure consistent behavior on
        // 32 and 64 bit targets: value is typically used to determine buffer
        // allocation size.
        if (*value > UINT32_MAX) return -1;

        ...
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants