From: Ezequiel Garcia <ezequiel@collabora.com>
To: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: kernel@collabora.com, Jonas Karlman <jonas@kwiboo.se>,
Hans Verkuil <hverkuil@xs4all.nl>,
Nicolas Dufresne <nicolas.dufresne@collabora.com>,
Philipp Zabel <p.zabel@pengutronix.de>,
Maxime Ripard <mripard@kernel.org>,
Paul Kocialkowski <paul.kocialkowski@bootlin.com>,
Jernej Skrabec <jernej.skrabec@siol.net>,
Ezequiel Garcia <ezequiel@collabora.com>
Subject: [PATCH v5 07/14] media: controls: Validate H264 stateless controls
Date: Thu, 26 Nov 2020 06:36:11 -0300 [thread overview]
Message-ID: <20201126093618.137292-8-ezequiel@collabora.com> (raw)
In-Reply-To: <20201126093618.137292-1-ezequiel@collabora.com>
Check that all the fields that correspond or are related
to a H264 specification syntax element have legal values.
Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
Tested-by: Jernej Skrabec <jernej.skrabec@siol.net>
---
drivers/media/v4l2-core/v4l2-ctrls.c | 134 +++++++++++++++++++++++++++
include/media/h264-ctrls.h | 9 ++
2 files changed, 143 insertions(+)
diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index 88ad475bd716..6a17a7487459 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -1775,6 +1775,9 @@ static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,
{
struct v4l2_ctrl_mpeg2_slice_params *p_mpeg2_slice_params;
struct v4l2_ctrl_vp8_frame_header *p_vp8_frame_header;
+ struct v4l2_ctrl_h264_sps *p_h264_sps;
+ struct v4l2_ctrl_h264_pps *p_h264_pps;
+ struct v4l2_ctrl_h264_pred_weights *p_h264_pred_weights;
struct v4l2_ctrl_h264_slice_params *p_h264_slice_params;
struct v4l2_ctrl_h264_decode_params *p_h264_dec_params;
struct v4l2_ctrl_hevc_sps *p_hevc_sps;
@@ -1834,20 +1837,151 @@ static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,
break;
case V4L2_CTRL_TYPE_H264_SPS:
+ p_h264_sps = p;
+
+ /* Some syntax elements are only conditionally valid */
+ if (p_h264_sps->pic_order_cnt_type != 0) {
+ p_h264_sps->log2_max_pic_order_cnt_lsb_minus4 = 0;
+ } else if (p_h264_sps->pic_order_cnt_type != 1) {
+ p_h264_sps->num_ref_frames_in_pic_order_cnt_cycle = 0;
+ p_h264_sps->offset_for_non_ref_pic = 0;
+ p_h264_sps->offset_for_top_to_bottom_field = 0;
+ memset(&p_h264_sps->offset_for_ref_frame, 0,
+ sizeof(p_h264_sps->offset_for_ref_frame));
+ }
+
+ if (!V4L2_H264_SPS_HAS_CHROMA_FORMAT(p_h264_sps)) {
+ p_h264_sps->chroma_format_idc = 1;
+ p_h264_sps->bit_depth_luma_minus8 = 0;
+ p_h264_sps->bit_depth_chroma_minus8 = 0;
+
+ p_h264_sps->flags &=
+ ~V4L2_H264_SPS_FLAG_QPPRIME_Y_ZERO_TRANSFORM_BYPASS;
+
+ if (p_h264_sps->chroma_format_idc < 3)
+ p_h264_sps->flags &=
+ ~V4L2_H264_SPS_FLAG_SEPARATE_COLOUR_PLANE;
+ }
+
+ if (p_h264_sps->flags & V4L2_H264_SPS_FLAG_FRAME_MBS_ONLY)
+ p_h264_sps->flags &=
+ ~V4L2_H264_SPS_FLAG_MB_ADAPTIVE_FRAME_FIELD;
+
+ /*
+ * Chroma 4:2:2 format require at least High 4:2:2 profile.
+ *
+ * The H264 specification and well-known parser implementations
+ * use profile-idc values directly, as that is clearer and
+ * less ambiguous. We do the same here.
+ */
+ if (p_h264_sps->profile_idc < 122 &&
+ p_h264_sps->chroma_format_idc > 1)
+ return -EINVAL;
+ /* Chroma 4:4:4 format require at least High 4:2:2 profile */
+ if (p_h264_sps->profile_idc < 244 &&
+ p_h264_sps->chroma_format_idc > 2)
+ return -EINVAL;
+ if (p_h264_sps->chroma_format_idc > 3)
+ return -EINVAL;
+
+ if (p_h264_sps->bit_depth_luma_minus8 > 6)
+ return -EINVAL;
+ if (p_h264_sps->bit_depth_chroma_minus8 > 6)
+ return -EINVAL;
+ if (p_h264_sps->log2_max_frame_num_minus4 > 12)
+ return -EINVAL;
+ if (p_h264_sps->pic_order_cnt_type > 2)
+ return -EINVAL;
+ if (p_h264_sps->log2_max_pic_order_cnt_lsb_minus4 > 12)
+ return -EINVAL;
+ if (p_h264_sps->max_num_ref_frames > V4L2_H264_REF_LIST_LEN)
+ return -EINVAL;
+ break;
+
case V4L2_CTRL_TYPE_H264_PPS:
+ p_h264_pps = p;
+
+ if (p_h264_pps->num_slice_groups_minus1 > 7)
+ return -EINVAL;
+ if (p_h264_pps->num_ref_idx_l0_default_active_minus1 >
+ (V4L2_H264_REF_LIST_LEN - 1))
+ return -EINVAL;
+ if (p_h264_pps->num_ref_idx_l1_default_active_minus1 >
+ (V4L2_H264_REF_LIST_LEN - 1))
+ return -EINVAL;
+ if (p_h264_pps->weighted_bipred_idc > 2)
+ return -EINVAL;
+ /*
+ * pic_init_qp_minus26 shall be in the range of
+ * -(26 + QpBdOffset_y) to +25, inclusive,
+ * where QpBdOffset_y is 6 * bit_depth_luma_minus8
+ */
+ if (p_h264_pps->pic_init_qp_minus26 < -62 ||
+ p_h264_pps->pic_init_qp_minus26 > 25)
+ return -EINVAL;
+ if (p_h264_pps->pic_init_qs_minus26 < -26 ||
+ p_h264_pps->pic_init_qs_minus26 > 25)
+ return -EINVAL;
+ if (p_h264_pps->chroma_qp_index_offset < -12 ||
+ p_h264_pps->chroma_qp_index_offset > 12)
+ return -EINVAL;
+ if (p_h264_pps->second_chroma_qp_index_offset < -12 ||
+ p_h264_pps->second_chroma_qp_index_offset > 12)
+ return -EINVAL;
+ break;
+
case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
+ break;
+
case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:
+ p_h264_pred_weights = p;
+
+ if (p_h264_pred_weights->luma_log2_weight_denom > 7)
+ return -EINVAL;
+ if (p_h264_pred_weights->chroma_log2_weight_denom > 7)
+ return -EINVAL;
break;
case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
p_h264_slice_params = p;
+ if (p_h264_slice_params->slice_type != V4L2_H264_SLICE_TYPE_B)
+ p_h264_slice_params->flags &=
+ ~V4L2_H264_SLICE_FLAG_DIRECT_SPATIAL_MV_PRED;
+
+ if (p_h264_slice_params->colour_plane_id > 2)
+ return -EINVAL;
+ if (p_h264_slice_params->cabac_init_idc > 2)
+ return -EINVAL;
+ if (p_h264_slice_params->disable_deblocking_filter_idc > 2)
+ return -EINVAL;
+ if (p_h264_slice_params->slice_alpha_c0_offset_div2 < -6 ||
+ p_h264_slice_params->slice_alpha_c0_offset_div2 > 6)
+ return -EINVAL;
+ if (p_h264_slice_params->slice_beta_offset_div2 < -6 ||
+ p_h264_slice_params->slice_beta_offset_div2 > 6)
+ return -EINVAL;
+
+ if (p_h264_slice_params->slice_type == V4L2_H264_SLICE_TYPE_I ||
+ p_h264_slice_params->slice_type == V4L2_H264_SLICE_TYPE_SI)
+ p_h264_slice_params->num_ref_idx_l0_active_minus1 = 0;
+ if (p_h264_slice_params->slice_type != V4L2_H264_SLICE_TYPE_B)
+ p_h264_slice_params->num_ref_idx_l1_active_minus1 = 0;
+
+ if (p_h264_slice_params->num_ref_idx_l0_active_minus1 >
+ (V4L2_H264_REF_LIST_LEN - 1))
+ return -EINVAL;
+ if (p_h264_slice_params->num_ref_idx_l1_active_minus1 >
+ (V4L2_H264_REF_LIST_LEN - 1))
+ return -EINVAL;
zero_reserved(*p_h264_slice_params);
break;
case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:
p_h264_dec_params = p;
+ if (p_h264_dec_params->nal_ref_idc > 3)
+ return -EINVAL;
for (i = 0; i < V4L2_H264_NUM_DPB_ENTRIES; i++) {
struct v4l2_h264_dpb_entry *dpb_entry =
&p_h264_dec_params->dpb[i];
diff --git a/include/media/h264-ctrls.h b/include/media/h264-ctrls.h
index f86345b8efd1..083899c3ea19 100644
--- a/include/media/h264-ctrls.h
+++ b/include/media/h264-ctrls.h
@@ -98,6 +98,15 @@ enum v4l2_mpeg_video_h264_start_code {
#define V4L2_H264_SPS_FLAG_MB_ADAPTIVE_FRAME_FIELD 0x20
#define V4L2_H264_SPS_FLAG_DIRECT_8X8_INFERENCE 0x40
+#define V4L2_H264_SPS_HAS_CHROMA_FORMAT(sps) \
+ ((sps)->profile_idc == 100 || (sps)->profile_idc == 110 || \
+ (sps)->profile_idc == 122 || (sps)->profile_idc == 244 || \
+ (sps)->profile_idc == 44 || (sps)->profile_idc == 83 || \
+ (sps)->profile_idc == 86 || (sps)->profile_idc == 118 || \
+ (sps)->profile_idc == 128 || (sps)->profile_idc == 138 || \
+ (sps)->profile_idc == 139 || (sps)->profile_idc == 134 || \
+ (sps)->profile_idc == 135)
+
/**
* struct v4l2_ctrl_h264_sps - H264 sequence parameter set
*
--
2.27.0
next prev parent reply other threads:[~2020-11-26 9:37 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-26 9:36 [PATCH v5 00/14] Stateless H.264 de-staging Ezequiel Garcia
2020-11-26 9:36 ` [PATCH v5 01/14] media: vidioc-g-ext-ctrls.rst: document V4L2_CTRL_CLASS_DETECT Ezequiel Garcia
2020-11-26 9:36 ` [PATCH v5 02/14] media: controls: Add validate failure debug message Ezequiel Garcia
2020-11-26 9:36 ` [PATCH v5 03/14] media: rkvdec: h264: Support profile and level controls Ezequiel Garcia
2020-11-26 9:36 ` [PATCH v5 04/14] media: cedrus: h264: Support profile controls Ezequiel Garcia
2020-11-26 9:36 ` [PATCH v5 05/14] media: Rename stateful codec control macros Ezequiel Garcia
2020-11-26 9:36 ` [PATCH v5 06/14] media: Clean stateless control includes Ezequiel Garcia
2020-11-26 9:36 ` Ezequiel Garcia [this message]
2020-11-26 9:36 ` [PATCH v5 08/14] media: controls: Add the stateless codec control class Ezequiel Garcia
2020-11-26 9:36 ` [PATCH v5 09/14] media: uapi: Move parsed H264 pixel format out of staging Ezequiel Garcia
2020-11-26 9:36 ` [PATCH v5 10/14] media: doc: Replace symbol for V4L2_CTRL_TYPE_H264_PRED_WEIGHTS Ezequiel Garcia
2020-11-26 9:36 ` [PATCH v5 11/14] media: uapi: Move the H264 stateless control types out of staging Ezequiel Garcia
2020-11-26 9:36 ` [PATCH v5 12/14] media: controls: Log H264 stateless controls in .std_log Ezequiel Garcia
2020-11-26 9:36 ` [PATCH v5 13/14] media: uapi: move H264 stateless controls out of staging Ezequiel Garcia
2020-12-03 9:28 ` Mauro Carvalho Chehab
2020-12-03 9:46 ` Hans Verkuil
2020-11-26 9:36 ` [PATCH v5 14/14] media: docs: Move the H264 stateless codec uAPI Ezequiel Garcia
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201126093618.137292-8-ezequiel@collabora.com \
--to=ezequiel@collabora.com \
--cc=hverkuil@xs4all.nl \
--cc=jernej.skrabec@siol.net \
--cc=jonas@kwiboo.se \
--cc=kernel@collabora.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mripard@kernel.org \
--cc=nicolas.dufresne@collabora.com \
--cc=p.zabel@pengutronix.de \
--cc=paul.kocialkowski@bootlin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).