FFmpeg coverage

GCC Code Coverage Report

Directory:	../../../ffmpeg/		Exec	Total	Coverage
File:	src/libavcodec/h264_parse.c	Lines:	218	294	74.1 %
Date:	2021-04-18 10:33:33	Branches:	151	200	75.5 %


/*
 * This file is part of FFmpeg.
 *
 * FFmpeg is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * FFmpeg is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with FFmpeg; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

#include "bytestream.h"
#include "get_bits.h"
#include "golomb.h"
#include "h264.h"
#include "h264dec.h"
#include "h264_parse.h"
#include "h264_ps.h"

int ff_h264_pred_weight_table(GetBitContext *gb, const SPS *sps,
                              const int *ref_count, int slice_type_nos,
                              H264PredWeightTable *pwt,
                              int picture_structure, void *logctx)
{
    int list, i, j;
    int luma_def, chroma_def;

    pwt->use_weight             = 0;
    pwt->use_weight_chroma      = 0;

    pwt->luma_log2_weight_denom = get_ue_golomb_31(gb);
    if (pwt->luma_log2_weight_denom > 7U) {
        av_log(logctx, AV_LOG_ERROR, "luma_log2_weight_denom %d is out of range\n", pwt->luma_log2_weight_denom);
        pwt->luma_log2_weight_denom = 0;
    }
    luma_def = 1 << pwt->luma_log2_weight_denom;

    if (sps->chroma_format_idc) {
        pwt->chroma_log2_weight_denom = get_ue_golomb_31(gb);
        if (pwt->chroma_log2_weight_denom > 7U) {
            av_log(logctx, AV_LOG_ERROR, "chroma_log2_weight_denom %d is out of range\n", pwt->chroma_log2_weight_denom);
            pwt->chroma_log2_weight_denom = 0;
        }
        chroma_def = 1 << pwt->chroma_log2_weight_denom;
    }

    for (list = 0; list < 2; list++) {
        pwt->luma_weight_flag[list]   = 0;
        pwt->chroma_weight_flag[list] = 0;
        for (i = 0; i < ref_count[list]; i++) {
            int luma_weight_flag, chroma_weight_flag;

            luma_weight_flag = get_bits1(gb);
            if (luma_weight_flag) {
                pwt->luma_weight[i][list][0] = get_se_golomb(gb);
                pwt->luma_weight[i][list][1] = get_se_golomb(gb);
                if ((int8_t)pwt->luma_weight[i][list][0] != pwt->luma_weight[i][list][0] ||
                    (int8_t)pwt->luma_weight[i][list][1] != pwt->luma_weight[i][list][1])
                    goto out_range_weight;
                if (pwt->luma_weight[i][list][0] != luma_def ||
                    pwt->luma_weight[i][list][1] != 0) {
                    pwt->use_weight             = 1;
                    pwt->luma_weight_flag[list] = 1;
                }
            } else {
                pwt->luma_weight[i][list][0] = luma_def;
                pwt->luma_weight[i][list][1] = 0;
            }

            if (sps->chroma_format_idc) {
                chroma_weight_flag = get_bits1(gb);
                if (chroma_weight_flag) {
                    int j;
                    for (j = 0; j < 2; j++) {
                        pwt->chroma_weight[i][list][j][0] = get_se_golomb(gb);
                        pwt->chroma_weight[i][list][j][1] = get_se_golomb(gb);
                        if ((int8_t)pwt->chroma_weight[i][list][j][0] != pwt->chroma_weight[i][list][j][0] ||
                            (int8_t)pwt->chroma_weight[i][list][j][1] != pwt->chroma_weight[i][list][j][1]) {
                            pwt->chroma_weight[i][list][j][0] = chroma_def;
                            pwt->chroma_weight[i][list][j][1] = 0;
                            goto out_range_weight;
                        }
                        if (pwt->chroma_weight[i][list][j][0] != chroma_def ||
                            pwt->chroma_weight[i][list][j][1] != 0) {
                            pwt->use_weight_chroma        = 1;
                            pwt->chroma_weight_flag[list] = 1;
                        }
                    }
                } else {
                    int j;
                    for (j = 0; j < 2; j++) {
                        pwt->chroma_weight[i][list][j][0] = chroma_def;
                        pwt->chroma_weight[i][list][j][1] = 0;
                    }
                }
            }

            // for MBAFF
            if (picture_structure == PICT_FRAME) {
                pwt->luma_weight[16 + 2 * i][list][0] = pwt->luma_weight[16 + 2 * i + 1][list][0] = pwt->luma_weight[i][list][0];
                pwt->luma_weight[16 + 2 * i][list][1] = pwt->luma_weight[16 + 2 * i + 1][list][1] = pwt->luma_weight[i][list][1];
                if (sps->chroma_format_idc) {
                    for (j = 0; j < 2; j++) {
                        pwt->chroma_weight[16 + 2 * i][list][j][0] = pwt->chroma_weight[16 + 2 * i + 1][list][j][0] = pwt->chroma_weight[i][list][j][0];
                        pwt->chroma_weight[16 + 2 * i][list][j][1] = pwt->chroma_weight[16 + 2 * i + 1][list][j][1] = pwt->chroma_weight[i][list][j][1];
                    }
                }
            }
        }
        if (slice_type_nos != AV_PICTURE_TYPE_B)
            break;
    }
    pwt->use_weight = pwt->use_weight || pwt->use_weight_chroma;
    return 0;
out_range_weight:
    avpriv_request_sample(logctx, "Out of range weight");
    return AVERROR_INVALIDDATA;
}

/**
 * Check if the top & left blocks are available if needed and
 * change the dc mode so it only uses the available blocks.
 */
int ff_h264_check_intra4x4_pred_mode(int8_t *pred_mode_cache, void *logctx,
                                     int top_samples_available, int left_samples_available)
{
    static const int8_t top[12] = {
        -1, 0, LEFT_DC_PRED, -1, -1, -1, -1, -1, 0
    };
    static const int8_t left[12] = {
        0, -1, TOP_DC_PRED, 0, -1, -1, -1, 0, -1, DC_128_PRED
    };
    int i;

    if (!(top_samples_available & 0x8000)) {
        for (i = 0; i < 4; i++) {
            int status = top[pred_mode_cache[scan8[0] + i]];
            if (status < 0) {
                av_log(logctx, AV_LOG_ERROR,
                       "top block unavailable for requested intra mode %d\n",
                       status);
                return AVERROR_INVALIDDATA;
            } else if (status) {
                pred_mode_cache[scan8[0] + i] = status;
            }
        }
    }

    if ((left_samples_available & 0x8888) != 0x8888) {
        static const int mask[4] = { 0x8000, 0x2000, 0x80, 0x20 };
        for (i = 0; i < 4; i++)
            if (!(left_samples_available & mask[i])) {
                int status = left[pred_mode_cache[scan8[0] + 8 * i]];
                if (status < 0) {
                    av_log(logctx, AV_LOG_ERROR,
                           "left block unavailable for requested intra4x4 mode %d\n",
                           status);
                    return AVERROR_INVALIDDATA;
                } else if (status) {
                    pred_mode_cache[scan8[0] + 8 * i] = status;
                }
            }
    }

    return 0;
}

/**
 * Check if the top & left blocks are available if needed and
 * change the dc mode so it only uses the available blocks.
 */
int ff_h264_check_intra_pred_mode(void *logctx, int top_samples_available,
                                  int left_samples_available,
                                  int mode, int is_chroma)
{
    static const int8_t top[4]  = { LEFT_DC_PRED8x8, 1, -1, -1 };
    static const int8_t left[5] = { TOP_DC_PRED8x8, -1,  2, -1, DC_128_PRED8x8 };

    if (mode > 3U) {
        av_log(logctx, AV_LOG_ERROR,
               "out of range intra chroma pred mode\n");
        return AVERROR_INVALIDDATA;
    }

    if (!(top_samples_available & 0x8000)) {
        mode = top[mode];
        if (mode < 0) {
            av_log(logctx, AV_LOG_ERROR,
                   "top block unavailable for requested intra mode\n");
            return AVERROR_INVALIDDATA;
        }
    }

    if ((left_samples_available & 0x8080) != 0x8080) {
        mode = left[mode];
        if (mode < 0) {
            av_log(logctx, AV_LOG_ERROR,
                   "left block unavailable for requested intra mode\n");
            return AVERROR_INVALIDDATA;
        }
        if (is_chroma && (left_samples_available & 0x8080)) {
            // mad cow disease mode, aka MBAFF + constrained_intra_pred
            mode = ALZHEIMER_DC_L0T_PRED8x8 +
                   (!(left_samples_available & 0x8000)) +
                   2 * (mode == DC_128_PRED8x8);
        }
    }

    return mode;
}

int ff_h264_parse_ref_count(int *plist_count, int ref_count[2],
                            GetBitContext *gb, const PPS *pps,
                            int slice_type_nos, int picture_structure, void *logctx)
{
    int list_count;
    int num_ref_idx_active_override_flag;

    // set defaults, might be overridden a few lines later
    ref_count[0] = pps->ref_count[0];
    ref_count[1] = pps->ref_count[1];

    if (slice_type_nos != AV_PICTURE_TYPE_I) {
        unsigned max[2];
        max[0] = max[1] = picture_structure == PICT_FRAME ? 15 : 31;

        num_ref_idx_active_override_flag = get_bits1(gb);

        if (num_ref_idx_active_override_flag) {
            ref_count[0] = get_ue_golomb(gb) + 1;
            if (slice_type_nos == AV_PICTURE_TYPE_B) {
                ref_count[1] = get_ue_golomb(gb) + 1;
            } else
                // full range is spec-ok in this case, even for frames
                ref_count[1] = 1;
        }

        if (slice_type_nos == AV_PICTURE_TYPE_B)
            list_count = 2;
        else
            list_count = 1;

        if (ref_count[0] - 1 > max[0] || (list_count == 2 && (ref_count[1] - 1 > max[1]))) {
            av_log(logctx, AV_LOG_ERROR, "reference overflow %u > %u or %u > %u\n",
                   ref_count[0] - 1, max[0], ref_count[1] - 1, max[1]);
            ref_count[0] = ref_count[1] = 0;
            *plist_count = 0;
            goto fail;
        } else if (ref_count[1] - 1 > max[1]) {
            av_log(logctx, AV_LOG_DEBUG, "reference overflow %u > %u \n",
                   ref_count[1] - 1, max[1]);
            ref_count[1] = 0;
        }

    } else {
        list_count   = 0;
        ref_count[0] = ref_count[1] = 0;
    }

    *plist_count = list_count;

    return 0;
fail:
    *plist_count = 0;
    ref_count[0] = 0;
    ref_count[1] = 0;
    return AVERROR_INVALIDDATA;
}

int ff_h264_init_poc(int pic_field_poc[2], int *pic_poc,
                     const SPS *sps, H264POCContext *pc,
                     int picture_structure, int nal_ref_idc)
{
    const int max_frame_num = 1 << sps->log2_max_frame_num;
    int64_t field_poc[2];

    pc->frame_num_offset = pc->prev_frame_num_offset;
    if (pc->frame_num < pc->prev_frame_num)
        pc->frame_num_offset += max_frame_num;

    if (sps->poc_type == 0) {
        const int max_poc_lsb = 1 << sps->log2_max_poc_lsb;
        if (pc->prev_poc_lsb < 0)
            pc->prev_poc_lsb =  pc->poc_lsb;

        if (pc->poc_lsb < pc->prev_poc_lsb &&
            pc->prev_poc_lsb - pc->poc_lsb >= max_poc_lsb / 2)
            pc->poc_msb = pc->prev_poc_msb + max_poc_lsb;
        else if (pc->poc_lsb > pc->prev_poc_lsb &&
                 pc->prev_poc_lsb - pc->poc_lsb < -max_poc_lsb / 2)
            pc->poc_msb = pc->prev_poc_msb - max_poc_lsb;
        else
            pc->poc_msb = pc->prev_poc_msb;
        field_poc[0] =
        field_poc[1] = pc->poc_msb + pc->poc_lsb;
        if (picture_structure == PICT_FRAME)
            field_poc[1] += pc->delta_poc_bottom;
    } else if (sps->poc_type == 1) {
        int abs_frame_num;
        int64_t expected_delta_per_poc_cycle, expectedpoc;
        int i;

        if (sps->poc_cycle_length != 0)
            abs_frame_num = pc->frame_num_offset + pc->frame_num;
        else
            abs_frame_num = 0;

        if (nal_ref_idc == 0 && abs_frame_num > 0)
            abs_frame_num--;

        expected_delta_per_poc_cycle = 0;
        for (i = 0; i < sps->poc_cycle_length; i++)
            // FIXME integrate during sps parse
            expected_delta_per_poc_cycle += sps->offset_for_ref_frame[i];

        if (abs_frame_num > 0) {
            int poc_cycle_cnt          = (abs_frame_num - 1) / sps->poc_cycle_length;
            int frame_num_in_poc_cycle = (abs_frame_num - 1) % sps->poc_cycle_length;

            expectedpoc = poc_cycle_cnt * expected_delta_per_poc_cycle;
            for (i = 0; i <= frame_num_in_poc_cycle; i++)
                expectedpoc = expectedpoc + sps->offset_for_ref_frame[i];
        } else
            expectedpoc = 0;

        if (nal_ref_idc == 0)
            expectedpoc = expectedpoc + sps->offset_for_non_ref_pic;

        field_poc[0] = expectedpoc + pc->delta_poc[0];
        field_poc[1] = field_poc[0] + sps->offset_for_top_to_bottom_field;

        if (picture_structure == PICT_FRAME)
            field_poc[1] += pc->delta_poc[1];
    } else {
        int poc = 2 * (pc->frame_num_offset + pc->frame_num);

        if (!nal_ref_idc)
            poc--;

        field_poc[0] = poc;
        field_poc[1] = poc;
    }

    if (   field_poc[0] != (int)field_poc[0]
        || field_poc[1] != (int)field_poc[1])
        return AVERROR_INVALIDDATA;

    if (picture_structure != PICT_BOTTOM_FIELD)
        pic_field_poc[0] = field_poc[0];
    if (picture_structure != PICT_TOP_FIELD)
        pic_field_poc[1] = field_poc[1];
    *pic_poc = FFMIN(pic_field_poc[0], pic_field_poc[1]);

    return 0;
}

static int decode_extradata_ps(const uint8_t *data, int size, H264ParamSets *ps,
                               int is_avc, void *logctx)
{
    H2645Packet pkt = { 0 };
    int i, ret = 0;

    ret = ff_h2645_packet_split(&pkt, data, size, logctx, is_avc, 2, AV_CODEC_ID_H264, 1, 0);
    if (ret < 0) {
        ret = 0;
        goto fail;
    }

    for (i = 0; i < pkt.nb_nals; i++) {
        H2645NAL *nal = &pkt.nals[i];
        switch (nal->type) {
        case H264_NAL_SPS: {
            GetBitContext tmp_gb = nal->gb;
            ret = ff_h264_decode_seq_parameter_set(&tmp_gb, logctx, ps, 0);
            if (ret >= 0)
                break;
            av_log(logctx, AV_LOG_DEBUG,
                   "SPS decoding failure, trying again with the complete NAL\n");
            init_get_bits8(&tmp_gb, nal->raw_data + 1, nal->raw_size - 1);
            ret = ff_h264_decode_seq_parameter_set(&tmp_gb, logctx, ps, 0);
            if (ret >= 0)
                break;
            ret = ff_h264_decode_seq_parameter_set(&nal->gb, logctx, ps, 1);
            if (ret < 0)
                goto fail;
            break;
        }
        case H264_NAL_PPS:
            ret = ff_h264_decode_picture_parameter_set(&nal->gb, logctx, ps,
                                                       nal->size_bits);
            if (ret < 0)
                goto fail;
            break;
        default:
            av_log(logctx, AV_LOG_VERBOSE, "Ignoring NAL type %d in extradata\n",
                   nal->type);
            break;
        }
    }

fail:
    ff_h2645_packet_uninit(&pkt);
    return ret;
}

/* There are (invalid) samples in the wild with mp4-style extradata, where the
 * parameter sets are stored unescaped (i.e. as RBSP).
 * This function catches the parameter set decoding failure and tries again
 * after escaping it */
static int decode_extradata_ps_mp4(const uint8_t *buf, int buf_size, H264ParamSets *ps,
                                   int err_recognition, void *logctx)
{
    int ret;

    ret = decode_extradata_ps(buf, buf_size, ps, 1, logctx);
    if (ret < 0 && !(err_recognition & AV_EF_EXPLODE)) {
        GetByteContext gbc;
        PutByteContext pbc;
        uint8_t *escaped_buf;
        int escaped_buf_size;

        av_log(logctx, AV_LOG_WARNING,
               "SPS decoding failure, trying again after escaping the NAL\n");

        if (buf_size / 2 >= (INT16_MAX - AV_INPUT_BUFFER_PADDING_SIZE) / 3)
            return AVERROR(ERANGE);
        escaped_buf_size = buf_size * 3 / 2 + AV_INPUT_BUFFER_PADDING_SIZE;
        escaped_buf = av_mallocz(escaped_buf_size);
        if (!escaped_buf)
            return AVERROR(ENOMEM);

        bytestream2_init(&gbc, buf, buf_size);
        bytestream2_init_writer(&pbc, escaped_buf, escaped_buf_size);

        while (bytestream2_get_bytes_left(&gbc)) {
            if (bytestream2_get_bytes_left(&gbc) >= 3 &&
                bytestream2_peek_be24(&gbc) <= 3) {
                bytestream2_put_be24(&pbc, 3);
                bytestream2_skip(&gbc, 2);
            } else
                bytestream2_put_byte(&pbc, bytestream2_get_byte(&gbc));
        }

        escaped_buf_size = bytestream2_tell_p(&pbc);
        AV_WB16(escaped_buf, escaped_buf_size - 2);

        (void)decode_extradata_ps(escaped_buf, escaped_buf_size, ps, 1, logctx);
        // lorex.mp4 decodes ok even with extradata decoding failing
        av_freep(&escaped_buf);
    }

    return 0;
}

int ff_h264_decode_extradata(const uint8_t *data, int size, H264ParamSets *ps,
                             int *is_avc, int *nal_length_size,
                             int err_recognition, void *logctx)
{
    int ret;

    if (!data || size <= 0)
        return -1;

    if (data[0] == 1) {
        int i, cnt, nalsize;
        const uint8_t *p = data;

        *is_avc = 1;

        if (size < 7) {
            av_log(logctx, AV_LOG_ERROR, "avcC %d too short\n", size);
            return AVERROR_INVALIDDATA;
        }

        // Decode sps from avcC
        cnt = *(p + 5) & 0x1f; // Number of sps
        p  += 6;
        for (i = 0; i < cnt; i++) {
            nalsize = AV_RB16(p) + 2;
            if (nalsize > size - (p - data))
                return AVERROR_INVALIDDATA;
            ret = decode_extradata_ps_mp4(p, nalsize, ps, err_recognition, logctx);
            if (ret < 0) {
                av_log(logctx, AV_LOG_ERROR,
                       "Decoding sps %d from avcC failed\n", i);
                return ret;
            }
            p += nalsize;
        }
        // Decode pps from avcC
        cnt = *(p++); // Number of pps
        for (i = 0; i < cnt; i++) {
            nalsize = AV_RB16(p) + 2;
            if (nalsize > size - (p - data))
                return AVERROR_INVALIDDATA;
            ret = decode_extradata_ps_mp4(p, nalsize, ps, err_recognition, logctx);
            if (ret < 0) {
                av_log(logctx, AV_LOG_ERROR,
                       "Decoding pps %d from avcC failed\n", i);
                return ret;
            }
            p += nalsize;
        }
        // Store right nal length size that will be used to parse all other nals
        *nal_length_size = (data[4] & 0x03) + 1;
    } else {
        *is_avc = 0;
        ret = decode_extradata_ps(data, size, ps, 0, logctx);
        if (ret < 0)
            return ret;
    }
    return size;
}

/**
 * Compute profile from profile_idc and constraint_set?_flags.
 *
 * @param sps SPS
 *
 * @return profile as defined by FF_PROFILE_H264_*
 */
int ff_h264_get_profile(const SPS *sps)
{
    int profile = sps->profile_idc;

    switch (sps->profile_idc) {
    case FF_PROFILE_H264_BASELINE:
        // constraint_set1_flag set to 1
        profile |= (sps->constraint_set_flags & 1 << 1) ? FF_PROFILE_H264_CONSTRAINED : 0;
        break;
    case FF_PROFILE_H264_HIGH_10:
    case FF_PROFILE_H264_HIGH_422:
    case FF_PROFILE_H264_HIGH_444_PREDICTIVE:
        // constraint_set3_flag set to 1
        profile |= (sps->constraint_set_flags & 1 << 3) ? FF_PROFILE_H264_INTRA : 0;
        break;
    }

    return profile;
}


Generated by: GCOVR (Version 4.2)

Line	Branch	Exec	Source
1			/*
2			* This file is part of FFmpeg.
3			*
4			* FFmpeg is free software; you can redistribute it and/or
5			* modify it under the terms of the GNU Lesser General Public
6			* License as published by the Free Software Foundation; either
7			* version 2.1 of the License, or (at your option) any later version.
8			*
9			* FFmpeg is distributed in the hope that it will be useful,
10			* but WITHOUT ANY WARRANTY; without even the implied warranty of
11			* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12			* Lesser General Public License for more details.
13			*
14			* You should have received a copy of the GNU Lesser General Public
15			* License along with FFmpeg; if not, write to the Free Software
16			* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
17			*/
18
19			#include "bytestream.h"
20			#include "get_bits.h"
21			#include "golomb.h"
22			#include "h264.h"
23			#include "h264dec.h"
24			#include "h264_parse.h"
25			#include "h264_ps.h"
26
27		2893	int ff_h264_pred_weight_table(GetBitContext gb, const SPS sps,
28			const int *ref_count, int slice_type_nos,
29			H264PredWeightTable *pwt,
30			int picture_structure, void *logctx)
31			{
32			int list, i, j;
33			int luma_def, chroma_def;
34
35		2893	pwt->use_weight = 0;
36		2893	pwt->use_weight_chroma = 0;
37
38		2893	pwt->luma_log2_weight_denom = get_ue_golomb_31(gb);
39	✗✓	2893	if (pwt->luma_log2_weight_denom > 7U) {
40			av_log(logctx, AV_LOG_ERROR, "luma_log2_weight_denom %d is out of range\n", pwt->luma_log2_weight_denom);
41			pwt->luma_log2_weight_denom = 0;
42			}
43		2893	luma_def = 1 << pwt->luma_log2_weight_denom;
44
45	✓✗	2893	if (sps->chroma_format_idc) {
46		2893	pwt->chroma_log2_weight_denom = get_ue_golomb_31(gb);
47	✗✓	2893	if (pwt->chroma_log2_weight_denom > 7U) {
48			av_log(logctx, AV_LOG_ERROR, "chroma_log2_weight_denom %d is out of range\n", pwt->chroma_log2_weight_denom);
49			pwt->chroma_log2_weight_denom = 0;
50			}
51		2893	chroma_def = 1 << pwt->chroma_log2_weight_denom;
52			}
53
54	✓✓	3485	for (list = 0; list < 2; list++) {
55		3189	pwt->luma_weight_flag[list] = 0;
56		3189	pwt->chroma_weight_flag[list] = 0;
57	✓✓	16174	for (i = 0; i < ref_count[list]; i++) {
58			int luma_weight_flag, chroma_weight_flag;
59
60		12985	luma_weight_flag = get_bits1(gb);
61	✓✓	12985	if (luma_weight_flag) {
62		5434	pwt->luma_weight[i][list][0] = get_se_golomb(gb);
63		5434	pwt->luma_weight[i][list][1] = get_se_golomb(gb);
64	✓✗	5434	if ((int8_t)pwt->luma_weight[i][list][0] != pwt->luma_weight[i][list][0] \|\|
65	✗✓	5434	(int8_t)pwt->luma_weight[i][list][1] != pwt->luma_weight[i][list][1])
66			goto out_range_weight;
67	✓✓	5434	if (pwt->luma_weight[i][list][0] != luma_def \|\|
68	✓✓	1665	pwt->luma_weight[i][list][1] != 0) {
69		4909	pwt->use_weight = 1;
70		4909	pwt->luma_weight_flag[list] = 1;
71			}
72			} else {
73		7551	pwt->luma_weight[i][list][0] = luma_def;
74		7551	pwt->luma_weight[i][list][1] = 0;
75			}
76
77	✓✗	12985	if (sps->chroma_format_idc) {
78		12985	chroma_weight_flag = get_bits1(gb);
79	✓✓	12985	if (chroma_weight_flag) {
80			int j;
81	✓✓	8538	for (j = 0; j < 2; j++) {
82		5692	pwt->chroma_weight[i][list][j][0] = get_se_golomb(gb);
83		5692	pwt->chroma_weight[i][list][j][1] = get_se_golomb(gb);
84	✓✗	5692	if ((int8_t)pwt->chroma_weight[i][list][j][0] != pwt->chroma_weight[i][list][j][0] \|\|
85	✗✓	5692	(int8_t)pwt->chroma_weight[i][list][j][1] != pwt->chroma_weight[i][list][j][1]) {
86			pwt->chroma_weight[i][list][j][0] = chroma_def;
87			pwt->chroma_weight[i][list][j][1] = 0;
88			goto out_range_weight;
89			}
90	✓✓	5692	if (pwt->chroma_weight[i][list][j][0] != chroma_def \|\|
91	✓✓	583	pwt->chroma_weight[i][list][j][1] != 0) {
92		5679	pwt->use_weight_chroma = 1;
93		5679	pwt->chroma_weight_flag[list] = 1;
94			}
95			}
96			} else {
97			int j;
98	✓✓	30417	for (j = 0; j < 2; j++) {
99		20278	pwt->chroma_weight[i][list][j][0] = chroma_def;
100		20278	pwt->chroma_weight[i][list][j][1] = 0;
101			}
102			}
103			}
104
105			// for MBAFF
106	✓✓	12985	if (picture_structure == PICT_FRAME) {
107		11493	pwt->luma_weight[16 + 2 * i][list][0] = pwt->luma_weight[16 + 2 * i + 1][list][0] = pwt->luma_weight[i][list][0];
108		11493	pwt->luma_weight[16 + 2 * i][list][1] = pwt->luma_weight[16 + 2 * i + 1][list][1] = pwt->luma_weight[i][list][1];
109	✓✗	11493	if (sps->chroma_format_idc) {
110	✓✓	34479	for (j = 0; j < 2; j++) {
111		22986	pwt->chroma_weight[16 + 2 * i][list][j][0] = pwt->chroma_weight[16 + 2 * i + 1][list][j][0] = pwt->chroma_weight[i][list][j][0];
112		22986	pwt->chroma_weight[16 + 2 * i][list][j][1] = pwt->chroma_weight[16 + 2 * i + 1][list][j][1] = pwt->chroma_weight[i][list][j][1];
113			}
114			}
115			}
116			}
117	✓✓	3189	if (slice_type_nos != AV_PICTURE_TYPE_B)
118		2597	break;
119			}
120	✓✓✓✓	2893	pwt->use_weight = pwt->use_weight \|\| pwt->use_weight_chroma;
121		2893	return 0;
122			out_range_weight:
123			avpriv_request_sample(logctx, "Out of range weight");
124			return AVERROR_INVALIDDATA;
125			}
126
127			/**
128			* Check if the top & left blocks are available if needed and
129			* change the dc mode so it only uses the available blocks.
130			*/
131		3004518	int ff_h264_check_intra4x4_pred_mode(int8_t pred_mode_cache, void logctx,
132			int top_samples_available, int left_samples_available)
133			{
134			static const int8_t top[12] = {
135			-1, 0, LEFT_DC_PRED, -1, -1, -1, -1, -1, 0
136			};
137			static const int8_t left[12] = {
138			0, -1, TOP_DC_PRED, 0, -1, -1, -1, 0, -1, DC_128_PRED
139			};
140			int i;
141
142	✓✓	3004518	if (!(top_samples_available & 0x8000)) {
143	✓✓	1026905	for (i = 0; i < 4; i++) {
144		821524	int status = top[pred_mode_cache[scan8[0] + i]];
145	✗✓	821524	if (status < 0) {
146			av_log(logctx, AV_LOG_ERROR,
147			"top block unavailable for requested intra mode %d\n",
148			status);
149			return AVERROR_INVALIDDATA;
150	✓✓	821524	} else if (status) {
151		532134	pred_mode_cache[scan8[0] + i] = status;
152			}
153			}
154			}
155
156	✓✓	3004518	if ((left_samples_available & 0x8888) != 0x8888) {
157			static const int mask[4] = { 0x8000, 0x2000, 0x80, 0x20 };
158	✓✓	333290	for (i = 0; i < 4; i++)
159	✓✓	266632	if (!(left_samples_available & mask[i])) {
160		266578	int status = left[pred_mode_cache[scan8[0] + 8 * i]];
161	✗✓	266578	if (status < 0) {
162			av_log(logctx, AV_LOG_ERROR,
163			"left block unavailable for requested intra4x4 mode %d\n",
164			status);
165			return AVERROR_INVALIDDATA;
166	✓✓	266578	} else if (status) {
167		96976	pred_mode_cache[scan8[0] + 8 * i] = status;
168			}
169			}
170			}
171
172		3004518	return 0;
173			}
174
175			/**
176			* Check if the top & left blocks are available if needed and
177			* change the dc mode so it only uses the available blocks.
178			*/
179		4599251	int ff_h264_check_intra_pred_mode(void *logctx, int top_samples_available,
180			int left_samples_available,
181			int mode, int is_chroma)
182			{
183			static const int8_t top[4] = { LEFT_DC_PRED8x8, 1, -1, -1 };
184			static const int8_t left[5] = { TOP_DC_PRED8x8, -1, 2, -1, DC_128_PRED8x8 };
185
186	✗✓	4599251	if (mode > 3U) {
187			av_log(logctx, AV_LOG_ERROR,
188			"out of range intra chroma pred mode\n");
189			return AVERROR_INVALIDDATA;
190			}
191
192	✓✓	4599251	if (!(top_samples_available & 0x8000)) {
193		338030	mode = top[mode];
194	✗✓	338030	if (mode < 0) {
195			av_log(logctx, AV_LOG_ERROR,
196			"top block unavailable for requested intra mode\n");
197			return AVERROR_INVALIDDATA;
198			}
199			}
200
201	✓✓	4599251	if ((left_samples_available & 0x8080) != 0x8080) {
202		100493	mode = left[mode];
203	✗✓	100493	if (mode < 0) {
204			av_log(logctx, AV_LOG_ERROR,
205			"left block unavailable for requested intra mode\n");
206			return AVERROR_INVALIDDATA;
207			}
208	✓✓✓✓	100493	if (is_chroma && (left_samples_available & 0x8080)) {
209			// mad cow disease mode, aka MBAFF + constrained_intra_pred
210		54	mode = ALZHEIMER_DC_L0T_PRED8x8 +
211	✓✓	27	(!(left_samples_available & 0x8000)) +
212	✓✓	27	2 * (mode == DC_128_PRED8x8);
213			}
214			}
215
216		4599251	return mode;
217			}
218
219		50443	int ff_h264_parse_ref_count(int *plist_count, int ref_count[2],
220			GetBitContext gb, const PPS pps,
221			int slice_type_nos, int picture_structure, void *logctx)
222			{
223			int list_count;
224			int num_ref_idx_active_override_flag;
225
226			// set defaults, might be overridden a few lines later
227		50443	ref_count[0] = pps->ref_count[0];
228		50443	ref_count[1] = pps->ref_count[1];
229
230	✓✓	50443	if (slice_type_nos != AV_PICTURE_TYPE_I) {
231			unsigned max[2];
232	✓✓	44561	max[0] = max[1] = picture_structure == PICT_FRAME ? 15 : 31;
233
234		44561	num_ref_idx_active_override_flag = get_bits1(gb);
235
236	✓✓	44561	if (num_ref_idx_active_override_flag) {
237		20144	ref_count[0] = get_ue_golomb(gb) + 1;
238	✓✓	20144	if (slice_type_nos == AV_PICTURE_TYPE_B) {
239		6146	ref_count[1] = get_ue_golomb(gb) + 1;
240			} else
241			// full range is spec-ok in this case, even for frames
242		13998	ref_count[1] = 1;
243			}
244
245	✓✓	44561	if (slice_type_nos == AV_PICTURE_TYPE_B)
246		12635	list_count = 2;
247			else
248		31926	list_count = 1;
249
250	✓✗✓✓ ✗✓	44561	if (ref_count[0] - 1 > max[0] \|\| (list_count == 2 && (ref_count[1] - 1 > max[1]))) {
251			av_log(logctx, AV_LOG_ERROR, "reference overflow %u > %u or %u > %u\n",
252			ref_count[0] - 1, max[0], ref_count[1] - 1, max[1]);
253			ref_count[0] = ref_count[1] = 0;
254			*plist_count = 0;
255			goto fail;
256	✗✓	44561	} else if (ref_count[1] - 1 > max[1]) {
257			av_log(logctx, AV_LOG_DEBUG, "reference overflow %u > %u \n",
258			ref_count[1] - 1, max[1]);
259			ref_count[1] = 0;
260			}
261
262			} else {
263		5882	list_count = 0;
264		5882	ref_count[0] = ref_count[1] = 0;
265			}
266
267		50443	*plist_count = list_count;
268
269		50443	return 0;
270			fail:
271			*plist_count = 0;
272			ref_count[0] = 0;
273			ref_count[1] = 0;
274			return AVERROR_INVALIDDATA;
275			}
276
277		52239	int ff_h264_init_poc(int pic_field_poc[2], int *pic_poc,
278			const SPS sps, H264POCContext pc,
279			int picture_structure, int nal_ref_idc)
280			{
281		52239	const int max_frame_num = 1 << sps->log2_max_frame_num;
282			int64_t field_poc[2];
283
284		52239	pc->frame_num_offset = pc->prev_frame_num_offset;
285	✓✓	52239	if (pc->frame_num < pc->prev_frame_num)
286		307	pc->frame_num_offset += max_frame_num;
287
288	✓✓	52239	if (sps->poc_type == 0) {
289		39547	const int max_poc_lsb = 1 << sps->log2_max_poc_lsb;
290	✓✓	39547	if (pc->prev_poc_lsb < 0)
291		749	pc->prev_poc_lsb = pc->poc_lsb;
292
293	✓✓	39547	if (pc->poc_lsb < pc->prev_poc_lsb &&
294	✓✓	18540	pc->prev_poc_lsb - pc->poc_lsb >= max_poc_lsb / 2)
295		231	pc->poc_msb = pc->prev_poc_msb + max_poc_lsb;
296	✓✓	39316	else if (pc->poc_lsb > pc->prev_poc_lsb &&
297	✓✓	18547	pc->prev_poc_lsb - pc->poc_lsb < -max_poc_lsb / 2)
298		211	pc->poc_msb = pc->prev_poc_msb - max_poc_lsb;
299			else
300		39105	pc->poc_msb = pc->prev_poc_msb;
301		39547	field_poc[0] =
302		39547	field_poc[1] = pc->poc_msb + pc->poc_lsb;
303	✓✓	39547	if (picture_structure == PICT_FRAME)
304		28099	field_poc[1] += pc->delta_poc_bottom;
305	✓✓	12692	} else if (sps->poc_type == 1) {
306			int abs_frame_num;
307			int64_t expected_delta_per_poc_cycle, expectedpoc;
308			int i;
309
310	✓✗	6180	if (sps->poc_cycle_length != 0)
311		6180	abs_frame_num = pc->frame_num_offset + pc->frame_num;
312			else
313			abs_frame_num = 0;
314
315	✓✓✓✗	6180	if (nal_ref_idc == 0 && abs_frame_num > 0)
316		397	abs_frame_num--;
317
318		6180	expected_delta_per_poc_cycle = 0;
319	✓✓	16194	for (i = 0; i < sps->poc_cycle_length; i++)
320			// FIXME integrate during sps parse
321		10014	expected_delta_per_poc_cycle += sps->offset_for_ref_frame[i];
322
323	✓✓	6180	if (abs_frame_num > 0) {
324		6098	int poc_cycle_cnt = (abs_frame_num - 1) / sps->poc_cycle_length;
325		6098	int frame_num_in_poc_cycle = (abs_frame_num - 1) % sps->poc_cycle_length;
326
327		6098	expectedpoc = poc_cycle_cnt * expected_delta_per_poc_cycle;
328	✓✓	14018	for (i = 0; i <= frame_num_in_poc_cycle; i++)
329		7920	expectedpoc = expectedpoc + sps->offset_for_ref_frame[i];
330			} else
331		82	expectedpoc = 0;
332
333	✓✓	6180	if (nal_ref_idc == 0)
334		397	expectedpoc = expectedpoc + sps->offset_for_non_ref_pic;
335
336		6180	field_poc[0] = expectedpoc + pc->delta_poc[0];
337		6180	field_poc[1] = field_poc[0] + sps->offset_for_top_to_bottom_field;
338
339	✓✓	6180	if (picture_structure == PICT_FRAME)
340		5249	field_poc[1] += pc->delta_poc[1];
341			} else {
342		6512	int poc = 2 * (pc->frame_num_offset + pc->frame_num);
343
344	✗✓	6512	if (!nal_ref_idc)
345			poc--;
346
347		6512	field_poc[0] = poc;
348		6512	field_poc[1] = poc;
349			}
350
351	✓✗	52239	if ( field_poc[0] != (int)field_poc[0]
352	✗✓	52239	\|\| field_poc[1] != (int)field_poc[1])
353			return AVERROR_INVALIDDATA;
354
355	✓✓	52239	if (picture_structure != PICT_BOTTOM_FIELD)
356		46057	pic_field_poc[0] = field_poc[0];
357	✓✓	52239	if (picture_structure != PICT_TOP_FIELD)
358		46042	pic_field_poc[1] = field_poc[1];
359		52239	*pic_poc = FFMIN(pic_field_poc[0], pic_field_poc[1]);
360
361		52239	return 0;
362			}
363
364		512	static int decode_extradata_ps(const uint8_t data, int size, H264ParamSets ps,
365			int is_avc, void *logctx)
366			{
367		512	H2645Packet pkt = { 0 };
368		512	int i, ret = 0;
369
370		512	ret = ff_h2645_packet_split(&pkt, data, size, logctx, is_avc, 2, AV_CODEC_ID_H264, 1, 0);
371	✗✓	512	if (ret < 0) {
372			ret = 0;
373			goto fail;
374			}
375
376	✓✓	1233	for (i = 0; i < pkt.nb_nals; i++) {
377		721	H2645NAL *nal = &pkt.nals[i];
378	✓✓✗	721	switch (nal->type) {
379		360	case H264_NAL_SPS: {
380		360	GetBitContext tmp_gb = nal->gb;
381		360	ret = ff_h264_decode_seq_parameter_set(&tmp_gb, logctx, ps, 0);
382	✓✓	360	if (ret >= 0)
383		360	break;
384		2	av_log(logctx, AV_LOG_DEBUG,
385			"SPS decoding failure, trying again with the complete NAL\n");
386		2	init_get_bits8(&tmp_gb, nal->raw_data + 1, nal->raw_size - 1);
387		2	ret = ff_h264_decode_seq_parameter_set(&tmp_gb, logctx, ps, 0);
388	✓✗	2	if (ret >= 0)
389		2	break;
390			ret = ff_h264_decode_seq_parameter_set(&nal->gb, logctx, ps, 1);
391			if (ret < 0)
392			goto fail;
393			break;
394			}
395		361	case H264_NAL_PPS:
396		361	ret = ff_h264_decode_picture_parameter_set(&nal->gb, logctx, ps,
397			nal->size_bits);
398	✗✓	361	if (ret < 0)
399			goto fail;
400		361	break;
401			default:
402			av_log(logctx, AV_LOG_VERBOSE, "Ignoring NAL type %d in extradata\n",
403			nal->type);
404			break;
405			}
406			}
407
408		512	fail:
409		512	ff_h2645_packet_uninit(&pkt);
410		512	return ret;
411			}
412
413			/* There are (invalid) samples in the wild with mp4-style extradata, where the
414			* parameter sets are stored unescaped (i.e. as RBSP).
415			* This function catches the parameter set decoding failure and tries again
416			* after escaping it */
417		304	static int decode_extradata_ps_mp4(const uint8_t buf, int buf_size, H264ParamSets ps,
418			int err_recognition, void *logctx)
419			{
420			int ret;
421
422		304	ret = decode_extradata_ps(buf, buf_size, ps, 1, logctx);
423	✗✓✗✗	304	if (ret < 0 && !(err_recognition & AV_EF_EXPLODE)) {
424			GetByteContext gbc;
425			PutByteContext pbc;
426			uint8_t *escaped_buf;
427			int escaped_buf_size;
428
429			av_log(logctx, AV_LOG_WARNING,
430			"SPS decoding failure, trying again after escaping the NAL\n");
431
432			if (buf_size / 2 >= (INT16_MAX - AV_INPUT_BUFFER_PADDING_SIZE) / 3)
433			return AVERROR(ERANGE);
434			escaped_buf_size = buf_size * 3 / 2 + AV_INPUT_BUFFER_PADDING_SIZE;
435			escaped_buf = av_mallocz(escaped_buf_size);
436			if (!escaped_buf)
437			return AVERROR(ENOMEM);
438
439			bytestream2_init(&gbc, buf, buf_size);
440			bytestream2_init_writer(&pbc, escaped_buf, escaped_buf_size);
441
442			while (bytestream2_get_bytes_left(&gbc)) {
443			if (bytestream2_get_bytes_left(&gbc) >= 3 &&
444			bytestream2_peek_be24(&gbc) <= 3) {
445			bytestream2_put_be24(&pbc, 3);
446			bytestream2_skip(&gbc, 2);
447			} else
448			bytestream2_put_byte(&pbc, bytestream2_get_byte(&gbc));
449			}
450
451			escaped_buf_size = bytestream2_tell_p(&pbc);
452			AV_WB16(escaped_buf, escaped_buf_size - 2);
453
454			(void)decode_extradata_ps(escaped_buf, escaped_buf_size, ps, 1, logctx);
455			// lorex.mp4 decodes ok even with extradata decoding failing
456			av_freep(&escaped_buf);
457			}
458
459		304	return 0;
460			}
461
462		363	int ff_h264_decode_extradata(const uint8_t data, int size, H264ParamSets ps,
463			int is_avc, int nal_length_size,
464			int err_recognition, void *logctx)
465			{
466			int ret;
467
468	✓✗✗✓	363	if (!data \|\| size <= 0)
469			return -1;
470
471	✓✓	363	if (data[0] == 1) {
472			int i, cnt, nalsize;
473		155	const uint8_t *p = data;
474
475		155	*is_avc = 1;
476
477	✗✓	155	if (size < 7) {
478			av_log(logctx, AV_LOG_ERROR, "avcC %d too short\n", size);
479			return AVERROR_INVALIDDATA;
480			}
481
482			// Decode sps from avcC
483		155	cnt = *(p + 5) & 0x1f; // Number of sps
484		155	p += 6;
485	✓✓	307	for (i = 0; i < cnt; i++) {
486		152	nalsize = AV_RB16(p) + 2;
487	✗✓	152	if (nalsize > size - (p - data))
488			return AVERROR_INVALIDDATA;
489		152	ret = decode_extradata_ps_mp4(p, nalsize, ps, err_recognition, logctx);
490	✗✓	152	if (ret < 0) {
491			av_log(logctx, AV_LOG_ERROR,
492			"Decoding sps %d from avcC failed\n", i);
493			return ret;
494			}
495		152	p += nalsize;
496			}
497			// Decode pps from avcC
498		155	cnt = *(p++); // Number of pps
499	✓✓	307	for (i = 0; i < cnt; i++) {
500		152	nalsize = AV_RB16(p) + 2;
501	✗✓	152	if (nalsize > size - (p - data))
502			return AVERROR_INVALIDDATA;
503		152	ret = decode_extradata_ps_mp4(p, nalsize, ps, err_recognition, logctx);
504	✗✓	152	if (ret < 0) {
505			av_log(logctx, AV_LOG_ERROR,
506			"Decoding pps %d from avcC failed\n", i);
507			return ret;
508			}
509		152	p += nalsize;
510			}
511			// Store right nal length size that will be used to parse all other nals
512		155	*nal_length_size = (data[4] & 0x03) + 1;
513			} else {
514		208	*is_avc = 0;
515		208	ret = decode_extradata_ps(data, size, ps, 0, logctx);
516	✗✓	208	if (ret < 0)
517			return ret;
518			}
519		363	return size;
520			}
521
522			/**
523			* Compute profile from profile_idc and constraint_set?_flags.
524			*
525			* @param sps SPS
526			*
527			* @return profile as defined by FF_PROFILE_H264_*
528			*/
529		52239	int ff_h264_get_profile(const SPS *sps)
530			{
531		52239	int profile = sps->profile_idc;
532
533	✓✓✓	52239	switch (sps->profile_idc) {
534		13630	case FF_PROFILE_H264_BASELINE:
535			// constraint_set1_flag set to 1
536		13630	profile \|= (sps->constraint_set_flags & 1 << 1) ? FF_PROFILE_H264_CONSTRAINED : 0;
537		13630	break;
538		1797	case FF_PROFILE_H264_HIGH_10:
539			case FF_PROFILE_H264_HIGH_422:
540			case FF_PROFILE_H264_HIGH_444_PREDICTIVE:
541			// constraint_set3_flag set to 1
542		1797	profile \|= (sps->constraint_set_flags & 1 << 3) ? FF_PROFILE_H264_INTRA : 0;
543		1797	break;
544			}
545
546		52239	return profile;
547			}