diff mbox series

[v3,07/13] media: controls: Validate H264 stateless controls

Message ID 20201118184700.331213-8-ezequiel@collabora.com
State New
Headers show
Series Stateless H.264 de-staging | expand

Commit Message

Ezequiel Garcia Nov. 18, 2020, 6:46 p.m. UTC 
Check that all the fields that correspond or are related
to a H264 specification syntax element have legal values.

Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
---
 drivers/media/v4l2-core/v4l2-ctrls.c | 83 ++++++++++++++++++++++++++++
 1 file changed, 83 insertions(+)

Comments

Ezequiel Garcia Nov. 19, 2020, 12:09 p.m. UTC | #1 
Hello,

On Wed, 2020-11-18 at 15:46 -0300, Ezequiel Garcia wrote:
> Check that all the fields that correspond or are related
> to a H264 specification syntax element have legal values.
> 
> Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
> ---
>  drivers/media/v4l2-core/v4l2-ctrls.c | 83 ++++++++++++++++++++++++++++
>  1 file changed, 83 insertions(+)
> 
> diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
> index 21c1928a9df8..adcf47bddbe3 100644
> --- a/drivers/media/v4l2-core/v4l2-ctrls.c
> +++ b/drivers/media/v4l2-core/v4l2-ctrls.c
> @@ -1775,6 +1775,9 @@ static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,
>  {
>  	struct v4l2_ctrl_mpeg2_slice_params *p_mpeg2_slice_params;
>  	struct v4l2_ctrl_vp8_frame_header *p_vp8_frame_header;
> +	struct v4l2_ctrl_h264_sps *p_h264_sps;
> +	struct v4l2_ctrl_h264_pps *p_h264_pps;
> +	struct v4l2_ctrl_h264_pred_weights *p_h264_pred_weigths;
>  	struct v4l2_ctrl_h264_slice_params *p_h264_slice_params;
>  	struct v4l2_ctrl_h264_decode_params *p_h264_dec_params;
>  	struct v4l2_ctrl_hevc_sps *p_hevc_sps;
> @@ -1834,20 +1837,100 @@ static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,
>  		break;
>  
>  	case V4L2_CTRL_TYPE_H264_SPS:
> +		p_h264_sps = p;
> +
> +		/* Only monochrome and 4:2:0 allowed */
> +		if (p_h264_sps->profile_idc < V4L2_H264_PROFILE_IDC_HIGH_422 &&
> +		    p_h264_sps->chroma_format_idc > 1)
> +				return -EINVAL;
> +		/* 4:2:2 allowed */
> +		else if (p_h264_sps->profile_idc < V4L2_H264_PROFILE_IDC_HIGH_444 &&
> +			 p_h264_sps->chroma_format_idc > 2)
> +				return -EINVAL;
> +		else if (p_h264_sps->chroma_format_idc > 3)
> +				return -EINVAL;
> +
> +		if (p_h264_sps->bit_depth_luma_minus8 > 6)
> +			return -EINVAL;
> +		if (p_h264_sps->bit_depth_chroma_minus8 > 6)
> +			return -EINVAL;
> +		if (p_h264_sps->log2_max_frame_num_minus4 > 12)
> +			return -EINVAL;
> +		if (p_h264_sps->pic_order_cnt_type > 2)
> +			return -EINVAL;
> +		if (p_h264_sps->log2_max_pic_order_cnt_lsb_minus4 > 12)
> +			return -EINVAL;

After a round of testing and some discussions with Jernej
on IRC, this patch needs some more discussion.

For instance, syntax element log2_max_pic_order_cnt_lsb_minus4
is only present if pic_order_cnt_type==0. It's easy to set it
to 0 in that case (although the spec doesn't specify any value).

Similarly, chroma_format_idc, bit_depth_luma_minus8,
bit_depth_chroma_minus8 elements are not present for some profiles.
The spec defines what are the values to be inferred in this case.

> +		if (p_h264_sps->max_num_ref_frames > V4L2_H264_REF_LIST_LEN)
> +			return -EINVAL;
> +		break;
> +
>  	case V4L2_CTRL_TYPE_H264_PPS:
> +		p_h264_pps = p;
> +
[snip]

>  
>  	case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
>  		p_h264_slice_params = p;
>  
> +		if (p_h264_slice_params->colour_plane_id > 2)
> +			return -EINVAL;
> +		if (p_h264_slice_params->cabac_init_idc > 2)
> +			return -EINVAL;

There are other cases which are more complex to solve. For instance,
cabac_init_idc which is specified if PPS element
entropy_coding_mode_flag is passed.

I believe applications (most of them will have to be adapted
anyway for the new API), will have to ensure cabac_init_idc is sane
before passing it to the kernel.

> +		if (p_h264_slice_params->disable_deblocking_filter_idc > 2)
> +			return -EINVAL;
> +		if (p_h264_slice_params->slice_alpha_c0_offset_div2 < -6 ||
> +		    p_h264_slice_params->slice_alpha_c0_offset_div2 > 6)
> +			return -EINVAL;
> +		if (p_h264_slice_params->slice_beta_offset_div2 < -6 ||
> +		    p_h264_slice_params->slice_beta_offset_div2 > 6)

Same here, these depends on PPS element deblocking_filter_control_present_flag.

I guess we can handle the simple ones, but those that depend
on elements from other NALUs might have to remain as-is.

Thanks,
Ezequiel
Hans Verkuil Nov. 20, 2020, 9:30 a.m. UTC | #2 
On 18/11/2020 19:46, Ezequiel Garcia wrote:
> Check that all the fields that correspond or are related

> to a H264 specification syntax element have legal values.

> 

> Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>

> ---

>  drivers/media/v4l2-core/v4l2-ctrls.c | 83 ++++++++++++++++++++++++++++

>  1 file changed, 83 insertions(+)

> 

> diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c

> index 21c1928a9df8..adcf47bddbe3 100644

> --- a/drivers/media/v4l2-core/v4l2-ctrls.c

> +++ b/drivers/media/v4l2-core/v4l2-ctrls.c

> @@ -1775,6 +1775,9 @@ static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,

>  {

>  	struct v4l2_ctrl_mpeg2_slice_params *p_mpeg2_slice_params;

>  	struct v4l2_ctrl_vp8_frame_header *p_vp8_frame_header;

> +	struct v4l2_ctrl_h264_sps *p_h264_sps;

> +	struct v4l2_ctrl_h264_pps *p_h264_pps;

> +	struct v4l2_ctrl_h264_pred_weights *p_h264_pred_weigths;


weigths -> weights

>  	struct v4l2_ctrl_h264_slice_params *p_h264_slice_params;

>  	struct v4l2_ctrl_h264_decode_params *p_h264_dec_params;

>  	struct v4l2_ctrl_hevc_sps *p_hevc_sps;

> @@ -1834,20 +1837,100 @@ static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,

>  		break;

>  

>  	case V4L2_CTRL_TYPE_H264_SPS:

> +		p_h264_sps = p;

> +

> +		/* Only monochrome and 4:2:0 allowed */

> +		if (p_h264_sps->profile_idc < V4L2_H264_PROFILE_IDC_HIGH_422 &&

> +		    p_h264_sps->chroma_format_idc > 1)

> +				return -EINVAL;

> +		/* 4:2:2 allowed */

> +		else if (p_h264_sps->profile_idc < V4L2_H264_PROFILE_IDC_HIGH_444 &&


You can drop the 'else'.

> +			 p_h264_sps->chroma_format_idc > 2)

> +				return -EINVAL;

> +		else if (p_h264_sps->chroma_format_idc > 3)


Ditto.

> +				return -EINVAL;

> +

> +		if (p_h264_sps->bit_depth_luma_minus8 > 6)

> +			return -EINVAL;

> +		if (p_h264_sps->bit_depth_chroma_minus8 > 6)

> +			return -EINVAL;

> +		if (p_h264_sps->log2_max_frame_num_minus4 > 12)

> +			return -EINVAL;

> +		if (p_h264_sps->pic_order_cnt_type > 2)

> +			return -EINVAL;

> +		if (p_h264_sps->log2_max_pic_order_cnt_lsb_minus4 > 12)

> +			return -EINVAL;

> +		if (p_h264_sps->max_num_ref_frames > V4L2_H264_REF_LIST_LEN)

> +			return -EINVAL;

> +		break;

> +

>  	case V4L2_CTRL_TYPE_H264_PPS:

> +		p_h264_pps = p;

> +

> +		if (p_h264_pps->num_slice_groups_minus1 > 7)

> +			return -EINVAL;

> +		if (p_h264_pps->num_ref_idx_l0_default_active_minus1 >

> +		    (V4L2_H264_REF_LIST_LEN - 1))

> +			return -EINVAL;

> +		if (p_h264_pps->num_ref_idx_l1_default_active_minus1 >

> +		    (V4L2_H264_REF_LIST_LEN - 1))

> +			return -EINVAL;

> +		if (p_h264_pps->weighted_bipred_idc > 2)

> +			return -EINVAL;

> +		/*

> +		 * pic_init_qp_minus26 shall be in the range of

> +		 * -(26 + QpBdOffset_y) to +25, inclusive,

> +		 *  where QpBdOffset_y is 6 * bit_depth_luma_minus8

> +		 */

> +		if (p_h264_pps->pic_init_qp_minus26 < -62 ||

> +		    p_h264_pps->pic_init_qp_minus26 > 25)

> +			return -EINVAL;

> +		if (p_h264_pps->pic_init_qs_minus26 < -26 ||

> +		    p_h264_pps->pic_init_qs_minus26 > 25)

> +			return -EINVAL;

> +		if (p_h264_pps->chroma_qp_index_offset < -12 ||

> +		    p_h264_pps->chroma_qp_index_offset > 12)

> +			return -EINVAL;

> +		if (p_h264_pps->second_chroma_qp_index_offset < -12 ||

> +		    p_h264_pps->second_chroma_qp_index_offset > 12)

> +			return -EINVAL;

> +		break;

> +

>  	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:

> +		break;

> +

>  	case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:

> +		p_h264_pred_weigths = p;

> +

> +		if (p_h264_pred_weigths->luma_log2_weight_denom > 7)

> +			return -EINVAL;

> +		if (p_h264_pred_weigths->chroma_log2_weight_denom > 7)

> +			return -EINVAL;

>  		break;

>  

>  	case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:

>  		p_h264_slice_params = p;

>  

> +		if (p_h264_slice_params->colour_plane_id > 2)

> +			return -EINVAL;

> +		if (p_h264_slice_params->cabac_init_idc > 2)

> +			return -EINVAL;

> +		if (p_h264_slice_params->disable_deblocking_filter_idc > 2)

> +			return -EINVAL;

> +		if (p_h264_slice_params->slice_alpha_c0_offset_div2 < -6 ||

> +		    p_h264_slice_params->slice_alpha_c0_offset_div2 > 6)

> +			return -EINVAL;

> +		if (p_h264_slice_params->slice_beta_offset_div2 < -6 ||

> +		    p_h264_slice_params->slice_beta_offset_div2 > 6)

> +			return -EINVAL;

>  		zero_reserved(*p_h264_slice_params);

>  		break;

>  

>  	case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:

>  		p_h264_dec_params = p;

>  

> +		if (p_h264_dec_params->nal_ref_idc > 3)

> +			return -EINVAL;

>  		for (i = 0; i < V4L2_H264_NUM_DPB_ENTRIES; i++) {

>  			struct v4l2_h264_dpb_entry *dpb_entry =

>  				&p_h264_dec_params->dpb[i];

> 


General question: I don't see anything in std_init_compound() for these
controls. Is initializing these compound controls to 0 enough to make them
pass std_validate_compound()? It probably is, otherwise you'd see errors
in the compliance test, I guess.

Regards,

	Hans
Ezequiel Garcia Nov. 22, 2020, 12:48 a.m. UTC | #3 
On Fri, 2020-11-20 at 10:30 +0100, Hans Verkuil wrote:
> On 18/11/2020 19:46, Ezequiel Garcia wrote:

> > Check that all the fields that correspond or are related

> > to a H264 specification syntax element have legal values.

> > 

> > Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>

> > ---

> >  drivers/media/v4l2-core/v4l2-ctrls.c | 83 ++++++++++++++++++++++++++++

> >  1 file changed, 83 insertions(+)

> > 

[..]
> >  	case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:

> >  		p_h264_dec_params = p;

> >  

> > +		if (p_h264_dec_params->nal_ref_idc > 3)

> > +			return -EINVAL;

> >  		for (i = 0; i < V4L2_H264_NUM_DPB_ENTRIES; i++) {

> >  			struct v4l2_h264_dpb_entry *dpb_entry =

> >  				&p_h264_dec_params->dpb[i];

> > 

> 

> General question: I don't see anything in std_init_compound() for these

> controls. Is initializing these compound controls to 0 enough to make them

> pass std_validate_compound()? It probably is, otherwise you'd see errors

> in the compliance test, I guess.

> guess.

> 


Indeed. You can see all the checks are for fields to not
exceed some maximum value.

This is common in H264/HEVC: you'll see  spread of _minusN
syntax. This is so to make zero-valued syntax common,
which in turns creates more redundancy, and make headers
more compressed.

Thanks,
Ezequiel
diff mbox series

Patch

diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index 21c1928a9df8..adcf47bddbe3 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -1775,6 +1775,9 @@  static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,
 {
 	struct v4l2_ctrl_mpeg2_slice_params *p_mpeg2_slice_params;
 	struct v4l2_ctrl_vp8_frame_header *p_vp8_frame_header;
+	struct v4l2_ctrl_h264_sps *p_h264_sps;
+	struct v4l2_ctrl_h264_pps *p_h264_pps;
+	struct v4l2_ctrl_h264_pred_weights *p_h264_pred_weigths;
 	struct v4l2_ctrl_h264_slice_params *p_h264_slice_params;
 	struct v4l2_ctrl_h264_decode_params *p_h264_dec_params;
 	struct v4l2_ctrl_hevc_sps *p_hevc_sps;
@@ -1834,20 +1837,100 @@  static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,
 		break;
 
 	case V4L2_CTRL_TYPE_H264_SPS:
+		p_h264_sps = p;
+
+		/* Only monochrome and 4:2:0 allowed */
+		if (p_h264_sps->profile_idc < V4L2_H264_PROFILE_IDC_HIGH_422 &&
+		    p_h264_sps->chroma_format_idc > 1)
+				return -EINVAL;
+		/* 4:2:2 allowed */
+		else if (p_h264_sps->profile_idc < V4L2_H264_PROFILE_IDC_HIGH_444 &&
+			 p_h264_sps->chroma_format_idc > 2)
+				return -EINVAL;
+		else if (p_h264_sps->chroma_format_idc > 3)
+				return -EINVAL;
+
+		if (p_h264_sps->bit_depth_luma_minus8 > 6)
+			return -EINVAL;
+		if (p_h264_sps->bit_depth_chroma_minus8 > 6)
+			return -EINVAL;
+		if (p_h264_sps->log2_max_frame_num_minus4 > 12)
+			return -EINVAL;
+		if (p_h264_sps->pic_order_cnt_type > 2)
+			return -EINVAL;
+		if (p_h264_sps->log2_max_pic_order_cnt_lsb_minus4 > 12)
+			return -EINVAL;
+		if (p_h264_sps->max_num_ref_frames > V4L2_H264_REF_LIST_LEN)
+			return -EINVAL;
+		break;
+
 	case V4L2_CTRL_TYPE_H264_PPS:
+		p_h264_pps = p;
+
+		if (p_h264_pps->num_slice_groups_minus1 > 7)
+			return -EINVAL;
+		if (p_h264_pps->num_ref_idx_l0_default_active_minus1 >
+		    (V4L2_H264_REF_LIST_LEN - 1))
+			return -EINVAL;
+		if (p_h264_pps->num_ref_idx_l1_default_active_minus1 >
+		    (V4L2_H264_REF_LIST_LEN - 1))
+			return -EINVAL;
+		if (p_h264_pps->weighted_bipred_idc > 2)
+			return -EINVAL;
+		/*
+		 * pic_init_qp_minus26 shall be in the range of
+		 * -(26 + QpBdOffset_y) to +25, inclusive,
+		 *  where QpBdOffset_y is 6 * bit_depth_luma_minus8
+		 */
+		if (p_h264_pps->pic_init_qp_minus26 < -62 ||
+		    p_h264_pps->pic_init_qp_minus26 > 25)
+			return -EINVAL;
+		if (p_h264_pps->pic_init_qs_minus26 < -26 ||
+		    p_h264_pps->pic_init_qs_minus26 > 25)
+			return -EINVAL;
+		if (p_h264_pps->chroma_qp_index_offset < -12 ||
+		    p_h264_pps->chroma_qp_index_offset > 12)
+			return -EINVAL;
+		if (p_h264_pps->second_chroma_qp_index_offset < -12 ||
+		    p_h264_pps->second_chroma_qp_index_offset > 12)
+			return -EINVAL;
+		break;
+
 	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
+		break;
+
 	case V4L2_CTRL_TYPE_H264_PRED_WEIGHTS:
+		p_h264_pred_weigths = p;
+
+		if (p_h264_pred_weigths->luma_log2_weight_denom > 7)
+			return -EINVAL;
+		if (p_h264_pred_weigths->chroma_log2_weight_denom > 7)
+			return -EINVAL;
 		break;
 
 	case V4L2_CTRL_TYPE_H264_SLICE_PARAMS:
 		p_h264_slice_params = p;
 
+		if (p_h264_slice_params->colour_plane_id > 2)
+			return -EINVAL;
+		if (p_h264_slice_params->cabac_init_idc > 2)
+			return -EINVAL;
+		if (p_h264_slice_params->disable_deblocking_filter_idc > 2)
+			return -EINVAL;
+		if (p_h264_slice_params->slice_alpha_c0_offset_div2 < -6 ||
+		    p_h264_slice_params->slice_alpha_c0_offset_div2 > 6)
+			return -EINVAL;
+		if (p_h264_slice_params->slice_beta_offset_div2 < -6 ||
+		    p_h264_slice_params->slice_beta_offset_div2 > 6)
+			return -EINVAL;
 		zero_reserved(*p_h264_slice_params);
 		break;
 
 	case V4L2_CTRL_TYPE_H264_DECODE_PARAMS:
 		p_h264_dec_params = p;
 
+		if (p_h264_dec_params->nal_ref_idc > 3)
+			return -EINVAL;
 		for (i = 0; i < V4L2_H264_NUM_DPB_ENTRIES; i++) {
 			struct v4l2_h264_dpb_entry *dpb_entry =
 				&p_h264_dec_params->dpb[i];