[FFmpeg-devel] [PATCH] cbs_av1: Reject thirty-two zero bits in uvlc code

[Michael Niedermayer]

Hi

On Sun, Oct 22, 2023 at 07:35:52PM +0100, Mark Thompson wrote:
> The spec allows at least thirty-two zero bits followed by a one to mean
> 2^32-1, with no constraint on the number of zeroes.  The libaom
> reference decoder does not match this, instead reading thirty-two zeroes
> but not the following one to mean 2^32-1.  These two interpretations are
> incompatible and other implementations may follow one or the other.
> Therefore reject thirty-two zeroes because the intended behaviour is not
> clear.
> ---
> libaom, dav1d and SVT-AV1 all have the same nonstandard behaviour of stopping at thirty-two zeroes and not reading the one.  gav1 just rejects thirty-two zeroes.
> 
> This is also a source of arbitrarily large single syntax elements to hit <https://lists.ffmpeg.org/pipermail/ffmpeg-devel/2023-October/315973.html>.
> 
>  libavcodec/cbs_av1.c | 18 +++++++++++++-----
>  1 file changed, 13 insertions(+), 5 deletions(-)
> 
> diff --git a/libavcodec/cbs_av1.c b/libavcodec/cbs_av1.c
> index 1d9ac5ab44..13c749a25b 100644
> --- a/libavcodec/cbs_av1.c
> +++ b/libavcodec/cbs_av1.c
> @@ -36,7 +36,7 @@ static int cbs_av1_read_uvlc(CodedBitstreamContext *ctx, GetBitContext *gbc,
>      CBS_TRACE_READ_START();
> 
>      zeroes = 0;
> -    while (1) {
> +    while (zeroes < 32) {

what happened with this patch ?
the git master code still aborts

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The worst form of inequality is to try to make unequal things equal.
-- Aristotle
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20231226/a96e95f4/attachment.sig>