[FFmpeg-devel] [PATCH] cbs_av1: Reject thirty-two zero bits in uvlc code

[Michael Niedermayer]

On Tue, Dec 26, 2023 at 12:50:42AM +0100, Michael Niedermayer wrote:
> Hi
> 
> On Sun, Oct 22, 2023 at 07:35:52PM +0100, Mark Thompson wrote:
> > The spec allows at least thirty-two zero bits followed by a one to mean
> > 2^32-1, with no constraint on the number of zeroes.  The libaom
> > reference decoder does not match this, instead reading thirty-two zeroes
> > but not the following one to mean 2^32-1.  These two interpretations are
> > incompatible and other implementations may follow one or the other.
> > Therefore reject thirty-two zeroes because the intended behaviour is not
> > clear.
> > ---
> > libaom, dav1d and SVT-AV1 all have the same nonstandard behaviour of stopping at thirty-two zeroes and not reading the one.  gav1 just rejects thirty-two zeroes.
> > 
> > This is also a source of arbitrarily large single syntax elements to hit <https://lists.ffmpeg.org/pipermail/ffmpeg-devel/2023-October/315973.html>.
> > 
> >  libavcodec/cbs_av1.c | 18 +++++++++++++-----
> >  1 file changed, 13 insertions(+), 5 deletions(-)
> > 
> > diff --git a/libavcodec/cbs_av1.c b/libavcodec/cbs_av1.c
> > index 1d9ac5ab44..13c749a25b 100644
> > --- a/libavcodec/cbs_av1.c
> > +++ b/libavcodec/cbs_av1.c
> > @@ -36,7 +36,7 @@ static int cbs_av1_read_uvlc(CodedBitstreamContext *ctx, GetBitContext *gbc,
> >      CBS_TRACE_READ_START();
> > 
> >      zeroes = 0;
> > -    while (1) {
> > +    while (zeroes < 32) {
> 
> what happened with this patch ?
> the git master code still aborts

timeout (many times in fact)

will apply

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Dictatorship naturally arises out of democracy, and the most aggravated
form of tyranny and slavery out of the most extreme liberty. -- Plato
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20240721/2798cc1d/attachment.sig>