Avoid overflow when parsing H.264 SPS.
Check that |log2_max_frame_num_minus4| and
|log2_max_pic_order_cnt_lsb_minus4| are at most 28, resulting in a
field width of at most 32 bits.
Bug: chromium:877843
Change-Id: I684f92b8f0f2fcdbab24732d8e8381bc51a92752
Reviewed-on: https://webrtc-review.googlesource.com/101760
Reviewed-by: Stefan Holmer <stefan@webrtc.org>
Reviewed-by: Björn Terelius <terelius@webrtc.org>
Reviewed-by: Karl Wiberg <kwiberg@webrtc.org>
Commit-Queue: Niels Moller <nisse@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#24862}diff --git a/rtc_base/bitbuffer.cc b/rtc_base/bitbuffer.cc
index 025cfe1..be72d55 100644
--- a/rtc_base/bitbuffer.cc
+++ b/rtc_base/bitbuffer.cc
@@ -108,6 +108,10 @@
}
bool BitBuffer::PeekBits(uint32_t* val, size_t bit_count) {
+ // TODO(nisse): Could allow bit_count == 0 and always return success. But
+ // current code reads one byte beyond end of buffer in the case that
+ // RemainingBitCount() == 0 and bit_count == 0.
+ RTC_DCHECK(bit_count > 0);
if (!val || bit_count > RemainingBitCount() || bit_count > 32) {
return false;
}