1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4 
5 #include "media/video/h264_parser.h"
6 
7 #include <limits>
8 #include <memory>
9 
10 #include "base/logging.h"
11 #include "base/numerics/safe_math.h"
12 #include "base/stl_util.h"
13 #include "media/base/subsample_entry.h"
14 #include "ui/gfx/geometry/rect.h"
15 #include "ui/gfx/geometry/size.h"
16 
17 namespace media {
18 
19 namespace {
20 // Converts [|start|, |end|) range with |encrypted_ranges| into a vector of
21 // SubsampleEntry. |encrypted_ranges| must be with in the range defined by
22 // |start| and |end|.
23 // It is OK to pass in empty |encrypted_ranges|; this will return a vector
24 // with single SubsampleEntry with clear_bytes set to the size of the buffer.
EncryptedRangesToSubsampleEntry(const uint8_t * start,const uint8_t * end,const Ranges<const uint8_t * > & encrypted_ranges)25 std::vector<SubsampleEntry> EncryptedRangesToSubsampleEntry(
26     const uint8_t* start,
27     const uint8_t* end,
28     const Ranges<const uint8_t*>& encrypted_ranges) {
29   std::vector<SubsampleEntry> subsamples;
30   const uint8_t* cur = start;
31   for (size_t i = 0; i < encrypted_ranges.size(); ++i) {
32     SubsampleEntry subsample = {};
33 
34     const uint8_t* encrypted_start = encrypted_ranges.start(i);
35     DCHECK_GE(encrypted_start, cur)
36         << "Encrypted range started before the current buffer pointer.";
37     subsample.clear_bytes = encrypted_start - cur;
38 
39     const uint8_t* encrypted_end = encrypted_ranges.end(i);
40     subsample.cypher_bytes = encrypted_end - encrypted_start;
41 
42     subsamples.push_back(subsample);
43     cur = encrypted_end;
44     DCHECK_LE(cur, end) << "Encrypted range is outside the buffer range.";
45   }
46 
47   // If there is more data in the buffer but not covered by encrypted_ranges,
48   // then it must be in the clear.
49   if (cur < end) {
50     SubsampleEntry subsample = {};
51     subsample.clear_bytes = end - cur;
52     subsamples.push_back(subsample);
53   }
54   return subsamples;
55 }
56 }  // namespace
57 
IsPSlice() const58 bool H264SliceHeader::IsPSlice() const {
59   return (slice_type % 5 == kPSlice);
60 }
61 
IsBSlice() const62 bool H264SliceHeader::IsBSlice() const {
63   return (slice_type % 5 == kBSlice);
64 }
65 
IsISlice() const66 bool H264SliceHeader::IsISlice() const {
67   return (slice_type % 5 == kISlice);
68 }
69 
IsSPSlice() const70 bool H264SliceHeader::IsSPSlice() const {
71   return (slice_type % 5 == kSPSlice);
72 }
73 
IsSISlice() const74 bool H264SliceHeader::IsSISlice() const {
75   return (slice_type % 5 == kSISlice);
76 }
77 
H264NALU()78 H264NALU::H264NALU() {
79   memset(this, 0, sizeof(*this));
80 }
81 
82 // static
GetLevelConfigFromProfileLevel(VideoCodecProfile profile,uint8_t level,int * level_idc,bool * constraint_set3_flag)83 void H264SPS::GetLevelConfigFromProfileLevel(VideoCodecProfile profile,
84                                              uint8_t level,
85                                              int* level_idc,
86                                              bool* constraint_set3_flag) {
87   // Spec A.3.1.
88   // Note: we always use h264_output_level = 9 to indicate Level 1b in
89   //       VideoEncodeAccelerator::Config, in order to tell apart from Level 1.1
90   //       which level IDC is also 11.
91   // For Baseline and Main profile, if requested level is Level 1b, set
92   // level_idc to 11 and constraint_set3_flag to true. Otherwise, set level_idc
93   // to 9 for Level 1b, and ten times level number for others.
94   if ((profile == H264PROFILE_BASELINE || profile == H264PROFILE_MAIN) &&
95       level == kLevelIDC1B) {
96     *level_idc = 11;
97     *constraint_set3_flag = true;
98   } else {
99     *level_idc = level;
100   }
101 }
102 
H264SPS()103 H264SPS::H264SPS() {
104   memset(this, 0, sizeof(*this));
105 }
106 
107 // Based on T-REC-H.264 7.4.2.1.1, "Sequence parameter set data semantics",
108 // available from http://www.itu.int/rec/T-REC-H.264.
GetCodedSize() const109 base::Optional<gfx::Size> H264SPS::GetCodedSize() const {
110   // Interlaced frames are twice the height of each field.
111   const int mb_unit = 16;
112   int map_unit = frame_mbs_only_flag ? 16 : 32;
113 
114   // Verify that the values are not too large before multiplying them.
115   // TODO(sandersd): These limits could be much smaller. The currently-largest
116   // specified limit (excluding SVC, multiview, etc., which I didn't bother to
117   // read) is 543 macroblocks (section A.3.1).
118   int max_mb_minus1 = std::numeric_limits<int>::max() / mb_unit - 1;
119   int max_map_units_minus1 = std::numeric_limits<int>::max() / map_unit - 1;
120   if (pic_width_in_mbs_minus1 > max_mb_minus1 ||
121       pic_height_in_map_units_minus1 > max_map_units_minus1) {
122     DVLOG(1) << "Coded size is too large.";
123     return base::nullopt;
124   }
125 
126   return gfx::Size(mb_unit * (pic_width_in_mbs_minus1 + 1),
127                    map_unit * (pic_height_in_map_units_minus1 + 1));
128 }
129 
130 // Also based on section 7.4.2.1.1.
GetVisibleRect() const131 base::Optional<gfx::Rect> H264SPS::GetVisibleRect() const {
132   base::Optional<gfx::Size> coded_size = GetCodedSize();
133   if (!coded_size)
134     return base::nullopt;
135 
136   if (!frame_cropping_flag)
137     return gfx::Rect(coded_size.value());
138 
139   int crop_unit_x;
140   int crop_unit_y;
141   if (chroma_array_type == 0) {
142     crop_unit_x = 1;
143     crop_unit_y = frame_mbs_only_flag ? 1 : 2;
144   } else {
145     // Section 6.2.
146     // |chroma_format_idc| may be:
147     //   1 => 4:2:0
148     //   2 => 4:2:2
149     //   3 => 4:4:4
150     // Everything else has |chroma_array_type| == 0.
151     int sub_width_c = chroma_format_idc > 2 ? 1 : 2;
152     int sub_height_c = chroma_format_idc > 1 ? 1 : 2;
153     crop_unit_x = sub_width_c;
154     crop_unit_y = sub_height_c * (frame_mbs_only_flag ? 1 : 2);
155   }
156 
157   // Verify that the values are not too large before multiplying.
158   if (coded_size->width() / crop_unit_x < frame_crop_left_offset ||
159       coded_size->width() / crop_unit_x < frame_crop_right_offset ||
160       coded_size->height() / crop_unit_y < frame_crop_top_offset ||
161       coded_size->height() / crop_unit_y < frame_crop_bottom_offset) {
162     DVLOG(1) << "Frame cropping exceeds coded size.";
163     return base::nullopt;
164   }
165   int crop_left = crop_unit_x * frame_crop_left_offset;
166   int crop_right = crop_unit_x * frame_crop_right_offset;
167   int crop_top = crop_unit_y * frame_crop_top_offset;
168   int crop_bottom = crop_unit_y * frame_crop_bottom_offset;
169 
170   // Verify that the values are sane. Note that some decoders also require that
171   // crops are smaller than a macroblock and/or that crops must be adjacent to
172   // at least one corner of the coded frame.
173   if (coded_size->width() - crop_left <= crop_right ||
174       coded_size->height() - crop_top <= crop_bottom) {
175     DVLOG(1) << "Frame cropping excludes entire frame.";
176     return base::nullopt;
177   }
178 
179   return gfx::Rect(crop_left, crop_top,
180                    coded_size->width() - crop_left - crop_right,
181                    coded_size->height() - crop_top - crop_bottom);
182 }
183 
184 // Based on T-REC-H.264 E.2.1, "VUI parameters semantics",
185 // available from http://www.itu.int/rec/T-REC-H.264.
GetColorSpace() const186 VideoColorSpace H264SPS::GetColorSpace() const {
187   if (colour_description_present_flag) {
188     return VideoColorSpace(
189         colour_primaries, transfer_characteristics, matrix_coefficients,
190         video_full_range_flag ? gfx::ColorSpace::RangeID::FULL
191                               : gfx::ColorSpace::RangeID::LIMITED);
192   } else {
193     return VideoColorSpace();
194   }
195 }
196 
GetIndicatedLevel() const197 uint8_t H264SPS::GetIndicatedLevel() const {
198   // Spec A.3.1 and A.3.2
199   // For Baseline, Constrained Baseline and Main profile, the indicated level is
200   // Level 1b if level_idc is equal to 11 and constraint_set3_flag is true.
201   if ((profile_idc == H264SPS::kProfileIDCBaseline ||
202        profile_idc == H264SPS::kProfileIDCConstrainedBaseline ||
203        profile_idc == H264SPS::kProfileIDCMain) &&
204       level_idc == 11 && constraint_set3_flag) {
205     return kLevelIDC1B;  // Level 1b
206   }
207 
208   // Otherwise, the level_idc is equal to 9 for Level 1b, and others are equal
209   // to values of ten times the level numbers.
210   return base::checked_cast<uint8_t>(level_idc);
211 }
212 
CheckIndicatedLevelWithinTarget(uint8_t target_level) const213 bool H264SPS::CheckIndicatedLevelWithinTarget(uint8_t target_level) const {
214   // See table A-1 in spec.
215   // Level 1.0 < 1b < 1.1 < 1.2 .... (in numeric order).
216   uint8_t level = GetIndicatedLevel();
217   if (target_level == kLevelIDC1p0)
218     return level == kLevelIDC1p0;
219   if (target_level == kLevelIDC1B)
220     return level == kLevelIDC1p0 || level == kLevelIDC1B;
221   return level <= target_level;
222 }
223 
H264PPS()224 H264PPS::H264PPS() {
225   memset(this, 0, sizeof(*this));
226 }
227 
H264SliceHeader()228 H264SliceHeader::H264SliceHeader() {
229   memset(this, 0, sizeof(*this));
230 }
231 
H264SEIMessage()232 H264SEIMessage::H264SEIMessage() {
233   memset(this, 0, sizeof(*this));
234 }
235 
236 #define READ_BITS_OR_RETURN(num_bits, out)                                 \
237   do {                                                                     \
238     int _out;                                                              \
239     if (!br_.ReadBits(num_bits, &_out)) {                                  \
240       DVLOG(1)                                                             \
241           << "Error in stream: unexpected EOS while trying to read " #out; \
242       return kInvalidStream;                                               \
243     }                                                                      \
244     *out = _out;                                                           \
245   } while (0)
246 
247 #define READ_BOOL_OR_RETURN(out)                                           \
248   do {                                                                     \
249     int _out;                                                              \
250     if (!br_.ReadBits(1, &_out)) {                                         \
251       DVLOG(1)                                                             \
252           << "Error in stream: unexpected EOS while trying to read " #out; \
253       return kInvalidStream;                                               \
254     }                                                                      \
255     *out = _out != 0;                                                      \
256   } while (0)
257 
258 #define READ_UE_OR_RETURN(out)                                                 \
259   do {                                                                         \
260     if (ReadUE(out) != kOk) {                                                  \
261       DVLOG(1) << "Error in stream: invalid value while trying to read " #out; \
262       return kInvalidStream;                                                   \
263     }                                                                          \
264   } while (0)
265 
266 #define READ_SE_OR_RETURN(out)                                                 \
267   do {                                                                         \
268     if (ReadSE(out) != kOk) {                                                  \
269       DVLOG(1) << "Error in stream: invalid value while trying to read " #out; \
270       return kInvalidStream;                                                   \
271     }                                                                          \
272   } while (0)
273 
274 #define IN_RANGE_OR_RETURN(val, min, max)                                   \
275   do {                                                                      \
276     if ((val) < (min) || (val) > (max)) {                                   \
277       DVLOG(1) << "Error in stream: invalid value, expected " #val " to be" \
278                << " in range [" << (min) << ":" << (max) << "]"             \
279                << " found " << (val) << " instead";                         \
280       return kInvalidStream;                                                \
281     }                                                                       \
282   } while (0)
283 
284 #define TRUE_OR_RETURN(a)                                            \
285   do {                                                               \
286     if (!(a)) {                                                      \
287       DVLOG(1) << "Error in stream: invalid value, expected " << #a; \
288       return kInvalidStream;                                         \
289     }                                                                \
290   } while (0)
291 
292 // ISO 14496 part 10
293 // VUI parameters: Table E-1 "Meaning of sample aspect ratio indicator"
294 static const int kTableSarWidth[] = {0,  1,  12, 10, 16,  40, 24, 20, 32,
295                                      80, 18, 15, 64, 160, 4,  3,  2};
296 static const int kTableSarHeight[] = {0,  1,  11, 11, 11, 33, 11, 11, 11,
297                                       33, 11, 11, 33, 99, 3,  2,  1};
298 static_assert(base::size(kTableSarWidth) == base::size(kTableSarHeight),
299               "sar tables must have the same size");
300 
H264Parser()301 H264Parser::H264Parser() {
302   Reset();
303 }
304 
305 H264Parser::~H264Parser() = default;
306 
Reset()307 void H264Parser::Reset() {
308   stream_ = NULL;
309   bytes_left_ = 0;
310   encrypted_ranges_.clear();
311   previous_nalu_range_.clear();
312 }
313 
SetStream(const uint8_t * stream,off_t stream_size)314 void H264Parser::SetStream(const uint8_t* stream, off_t stream_size) {
315   std::vector<SubsampleEntry> subsamples;
316   SetEncryptedStream(stream, stream_size, subsamples);
317 }
318 
SetEncryptedStream(const uint8_t * stream,off_t stream_size,const std::vector<SubsampleEntry> & subsamples)319 void H264Parser::SetEncryptedStream(
320     const uint8_t* stream,
321     off_t stream_size,
322     const std::vector<SubsampleEntry>& subsamples) {
323   DCHECK(stream);
324   DCHECK_GT(stream_size, 0);
325 
326   stream_ = stream;
327   bytes_left_ = stream_size;
328   previous_nalu_range_.clear();
329 
330   encrypted_ranges_.clear();
331   const uint8_t* start = stream;
332   const uint8_t* stream_end = stream_ + bytes_left_;
333   for (size_t i = 0; i < subsamples.size() && start < stream_end; ++i) {
334     start += subsamples[i].clear_bytes;
335 
336     const uint8_t* end =
337         std::min(start + subsamples[i].cypher_bytes, stream_end);
338     encrypted_ranges_.Add(start, end);
339     start = end;
340   }
341 }
342 
GetPPS(int pps_id) const343 const H264PPS* H264Parser::GetPPS(int pps_id) const {
344   auto it = active_PPSes_.find(pps_id);
345   if (it == active_PPSes_.end()) {
346     DVLOG(1) << "Requested a nonexistent PPS id " << pps_id;
347     return nullptr;
348   }
349 
350   return it->second.get();
351 }
352 
GetSPS(int sps_id) const353 const H264SPS* H264Parser::GetSPS(int sps_id) const {
354   auto it = active_SPSes_.find(sps_id);
355   if (it == active_SPSes_.end()) {
356     DVLOG(1) << "Requested a nonexistent SPS id " << sps_id;
357     return nullptr;
358   }
359 
360   return it->second.get();
361 }
362 
IsStartCode(const uint8_t * data)363 static inline bool IsStartCode(const uint8_t* data) {
364   return data[0] == 0x00 && data[1] == 0x00 && data[2] == 0x01;
365 }
366 
367 // static
FindStartCode(const uint8_t * data,off_t data_size,off_t * offset,off_t * start_code_size)368 bool H264Parser::FindStartCode(const uint8_t* data,
369                                off_t data_size,
370                                off_t* offset,
371                                off_t* start_code_size) {
372   DCHECK_GE(data_size, 0);
373   off_t bytes_left = data_size;
374 
375   while (bytes_left >= 3) {
376     // The start code is "\0\0\1", ones are more unusual than zeroes, so let's
377     // search for it first.
378     const uint8_t* tmp =
379         reinterpret_cast<const uint8_t*>(memchr(data + 2, 1, bytes_left - 2));
380     if (!tmp) {
381       data += bytes_left - 2;
382       bytes_left = 2;
383       break;
384     }
385     tmp -= 2;
386     bytes_left -= tmp - data;
387     data = tmp;
388 
389     if (IsStartCode(data)) {
390       // Found three-byte start code, set pointer at its beginning.
391       *offset = data_size - bytes_left;
392       *start_code_size = 3;
393 
394       // If there is a zero byte before this start code,
395       // then it's actually a four-byte start code, so backtrack one byte.
396       if (*offset > 0 && *(data - 1) == 0x00) {
397         --(*offset);
398         ++(*start_code_size);
399       }
400 
401       return true;
402     }
403 
404     ++data;
405     --bytes_left;
406   }
407 
408   // End of data: offset is pointing to the first byte that was not considered
409   // as a possible start of a start code.
410   // Note: there is no security issue when receiving a negative |data_size|
411   // since in this case, |bytes_left| is equal to |data_size| and thus
412   // |*offset| is equal to 0 (valid offset).
413   *offset = data_size - bytes_left;
414   *start_code_size = 0;
415   return false;
416 }
417 
LocateNALU(off_t * nalu_size,off_t * start_code_size)418 bool H264Parser::LocateNALU(off_t* nalu_size, off_t* start_code_size) {
419   // Find the start code of next NALU.
420   off_t nalu_start_off = 0;
421   off_t annexb_start_code_size = 0;
422 
423   if (!FindStartCodeInClearRanges(stream_, bytes_left_, encrypted_ranges_,
424                                   &nalu_start_off, &annexb_start_code_size)) {
425     DVLOG(4) << "Could not find start code, end of stream?";
426     return false;
427   }
428 
429   // Move the stream to the beginning of the NALU (pointing at the start code).
430   stream_ += nalu_start_off;
431   bytes_left_ -= nalu_start_off;
432 
433   const uint8_t* nalu_data = stream_ + annexb_start_code_size;
434   off_t max_nalu_data_size = bytes_left_ - annexb_start_code_size;
435   if (max_nalu_data_size <= 0) {
436     DVLOG(3) << "End of stream";
437     return false;
438   }
439 
440   // Find the start code of next NALU;
441   // if successful, |nalu_size_without_start_code| is the number of bytes from
442   // after previous start code to before this one;
443   // if next start code is not found, it is still a valid NALU since there
444   // are some bytes left after the first start code: all the remaining bytes
445   // belong to the current NALU.
446   off_t next_start_code_size = 0;
447   off_t nalu_size_without_start_code = 0;
448   if (!FindStartCodeInClearRanges(
449           nalu_data, max_nalu_data_size, encrypted_ranges_,
450           &nalu_size_without_start_code, &next_start_code_size)) {
451     nalu_size_without_start_code = max_nalu_data_size;
452   }
453   *nalu_size = nalu_size_without_start_code + annexb_start_code_size;
454   *start_code_size = annexb_start_code_size;
455   return true;
456 }
457 
458 // static
FindStartCodeInClearRanges(const uint8_t * data,off_t data_size,const Ranges<const uint8_t * > & encrypted_ranges,off_t * offset,off_t * start_code_size)459 bool H264Parser::FindStartCodeInClearRanges(
460     const uint8_t* data,
461     off_t data_size,
462     const Ranges<const uint8_t*>& encrypted_ranges,
463     off_t* offset,
464     off_t* start_code_size) {
465   if (encrypted_ranges.size() == 0)
466     return FindStartCode(data, data_size, offset, start_code_size);
467 
468   DCHECK_GE(data_size, 0);
469   const uint8_t* start = data;
470   do {
471     off_t bytes_left = data_size - (start - data);
472 
473     if (!FindStartCode(start, bytes_left, offset, start_code_size))
474       return false;
475 
476     // Construct a Ranges object that represents the region occupied
477     // by the start code and the 1 byte needed to read the NAL unit type.
478     const uint8_t* start_code = start + *offset;
479     const uint8_t* start_code_end = start_code + *start_code_size;
480     Ranges<const uint8_t*> start_code_range;
481     start_code_range.Add(start_code, start_code_end + 1);
482 
483     if (encrypted_ranges.IntersectionWith(start_code_range).size() > 0) {
484       // The start code is inside an encrypted section so we need to scan
485       // for another start code.
486       *start_code_size = 0;
487       start += std::min(*offset + 1, bytes_left);
488     }
489   } while (*start_code_size == 0);
490 
491   // Update |*offset| to include the data we skipped over.
492   *offset += start - data;
493   return true;
494 }
495 
496 // static
ProfileIDCToVideoCodecProfile(int profile_idc)497 VideoCodecProfile H264Parser::ProfileIDCToVideoCodecProfile(int profile_idc) {
498   switch (profile_idc) {
499     case H264SPS::kProfileIDCBaseline:
500       return H264PROFILE_BASELINE;
501     case H264SPS::kProfileIDCMain:
502       return H264PROFILE_MAIN;
503     case H264SPS::kProfileIDCHigh:
504       return H264PROFILE_HIGH;
505     case H264SPS::kProfileIDHigh10:
506       return H264PROFILE_HIGH10PROFILE;
507     case H264SPS::kProfileIDHigh422:
508       return H264PROFILE_HIGH422PROFILE;
509     case H264SPS::kProfileIDHigh444Predictive:
510       return H264PROFILE_HIGH444PREDICTIVEPROFILE;
511     case H264SPS::kProfileIDScalableBaseline:
512       return H264PROFILE_SCALABLEBASELINE;
513     case H264SPS::kProfileIDScalableHigh:
514       return H264PROFILE_SCALABLEHIGH;
515     case H264SPS::kProfileIDStereoHigh:
516       return H264PROFILE_STEREOHIGH;
517     case H264SPS::kProfileIDSMultiviewHigh:
518       return H264PROFILE_MULTIVIEWHIGH;
519   }
520   DVLOG(1) << "unknown video profile: " << profile_idc;
521   return VIDEO_CODEC_PROFILE_UNKNOWN;
522 }
523 
524 // static
ParseNALUs(const uint8_t * stream,size_t stream_size,std::vector<H264NALU> * nalus)525 bool H264Parser::ParseNALUs(const uint8_t* stream,
526                             size_t stream_size,
527                             std::vector<H264NALU>* nalus) {
528   DCHECK(nalus);
529   H264Parser parser;
530   parser.SetStream(stream, stream_size);
531 
532   while (true) {
533     H264NALU nalu;
534     const H264Parser::Result result = parser.AdvanceToNextNALU(&nalu);
535     if (result == H264Parser::kOk) {
536       nalus->push_back(nalu);
537     } else if (result == media::H264Parser::kEOStream) {
538       return true;
539     } else {
540       DLOG(ERROR) << "Unexpected H264 parser result";
541       return false;
542     }
543   }
544   NOTREACHED();
545   return false;
546 }
547 
ReadUE(int * val)548 H264Parser::Result H264Parser::ReadUE(int* val) {
549   int num_bits = -1;
550   int bit;
551   int rest;
552 
553   // Count the number of contiguous zero bits.
554   do {
555     READ_BITS_OR_RETURN(1, &bit);
556     num_bits++;
557   } while (bit == 0);
558 
559   if (num_bits > 31)
560     return kInvalidStream;
561 
562   // Calculate exp-Golomb code value of size num_bits.
563   // Special case for |num_bits| == 31 to avoid integer overflow. The only
564   // valid representation as an int is 2^31 - 1, so the remaining bits must
565   // be 0 or else the number is too large.
566   *val = (1u << num_bits) - 1u;
567 
568   if (num_bits == 31) {
569     READ_BITS_OR_RETURN(num_bits, &rest);
570     return (rest == 0) ? kOk : kInvalidStream;
571   }
572 
573   if (num_bits > 0) {
574     READ_BITS_OR_RETURN(num_bits, &rest);
575     *val += rest;
576   }
577 
578   return kOk;
579 }
580 
ReadSE(int * val)581 H264Parser::Result H264Parser::ReadSE(int* val) {
582   int ue;
583   Result res;
584 
585   // See Chapter 9 in the spec.
586   res = ReadUE(&ue);
587   if (res != kOk)
588     return res;
589 
590   if (ue % 2 == 0)
591     *val = -(ue / 2);
592   else
593     *val = ue / 2 + 1;
594 
595   return kOk;
596 }
597 
AdvanceToNextNALU(H264NALU * nalu)598 H264Parser::Result H264Parser::AdvanceToNextNALU(H264NALU* nalu) {
599   off_t start_code_size;
600   off_t nalu_size_with_start_code;
601   if (!LocateNALU(&nalu_size_with_start_code, &start_code_size)) {
602     DVLOG(4) << "Could not find next NALU, bytes left in stream: "
603              << bytes_left_;
604     stream_ = nullptr;
605     bytes_left_ = 0;
606     return kEOStream;
607   }
608 
609   nalu->data = stream_ + start_code_size;
610   nalu->size = nalu_size_with_start_code - start_code_size;
611   DVLOG(4) << "NALU found: size=" << nalu_size_with_start_code;
612 
613   // Initialize bit reader at the start of found NALU.
614   if (!br_.Initialize(nalu->data, nalu->size)) {
615     stream_ = nullptr;
616     bytes_left_ = 0;
617     return kEOStream;
618   }
619 
620   // Move parser state to after this NALU, so next time AdvanceToNextNALU
621   // is called, we will effectively be skipping it;
622   // other parsing functions will use the position saved
623   // in bit reader for parsing, so we don't have to remember it here.
624   stream_ += nalu_size_with_start_code;
625   bytes_left_ -= nalu_size_with_start_code;
626 
627   // Read NALU header, skip the forbidden_zero_bit, but check for it.
628   int data;
629   READ_BITS_OR_RETURN(1, &data);
630   TRUE_OR_RETURN(data == 0);
631 
632   READ_BITS_OR_RETURN(2, &nalu->nal_ref_idc);
633   READ_BITS_OR_RETURN(5, &nalu->nal_unit_type);
634 
635   DVLOG(4) << "NALU type: " << static_cast<int>(nalu->nal_unit_type)
636            << " at: " << reinterpret_cast<const void*>(nalu->data)
637            << " size: " << nalu->size
638            << " ref: " << static_cast<int>(nalu->nal_ref_idc);
639 
640   previous_nalu_range_.clear();
641   previous_nalu_range_.Add(nalu->data, nalu->data + nalu->size);
642   return kOk;
643 }
644 
645 // Default scaling lists (per spec).
646 static const int kDefault4x4Intra[kH264ScalingList4x4Length] = {
647     6, 13, 13, 20, 20, 20, 28, 28, 28, 28, 32, 32, 32, 37, 37, 42,
648 };
649 
650 static const int kDefault4x4Inter[kH264ScalingList4x4Length] = {
651     10, 14, 14, 20, 20, 20, 24, 24, 24, 24, 27, 27, 27, 30, 30, 34,
652 };
653 
654 static const int kDefault8x8Intra[kH264ScalingList8x8Length] = {
655     6,  10, 10, 13, 11, 13, 16, 16, 16, 16, 18, 18, 18, 18, 18, 23,
656     23, 23, 23, 23, 23, 25, 25, 25, 25, 25, 25, 25, 27, 27, 27, 27,
657     27, 27, 27, 27, 29, 29, 29, 29, 29, 29, 29, 31, 31, 31, 31, 31,
658     31, 33, 33, 33, 33, 33, 36, 36, 36, 36, 38, 38, 38, 40, 40, 42,
659 };
660 
661 static const int kDefault8x8Inter[kH264ScalingList8x8Length] = {
662     9,  13, 13, 15, 13, 15, 17, 17, 17, 17, 19, 19, 19, 19, 19, 21,
663     21, 21, 21, 21, 21, 22, 22, 22, 22, 22, 22, 22, 24, 24, 24, 24,
664     24, 24, 24, 24, 25, 25, 25, 25, 25, 25, 25, 27, 27, 27, 27, 27,
665     27, 28, 28, 28, 28, 28, 30, 30, 30, 30, 32, 32, 32, 33, 33, 35,
666 };
667 
DefaultScalingList4x4(int i,int scaling_list4x4[][kH264ScalingList4x4Length])668 static inline void DefaultScalingList4x4(
669     int i,
670     int scaling_list4x4[][kH264ScalingList4x4Length]) {
671   DCHECK_LT(i, 6);
672 
673   if (i < 3)
674     memcpy(scaling_list4x4[i], kDefault4x4Intra, sizeof(kDefault4x4Intra));
675   else if (i < 6)
676     memcpy(scaling_list4x4[i], kDefault4x4Inter, sizeof(kDefault4x4Inter));
677 }
678 
DefaultScalingList8x8(int i,int scaling_list8x8[][kH264ScalingList8x8Length])679 static inline void DefaultScalingList8x8(
680     int i,
681     int scaling_list8x8[][kH264ScalingList8x8Length]) {
682   DCHECK_LT(i, 6);
683 
684   if (i % 2 == 0)
685     memcpy(scaling_list8x8[i], kDefault8x8Intra, sizeof(kDefault8x8Intra));
686   else
687     memcpy(scaling_list8x8[i], kDefault8x8Inter, sizeof(kDefault8x8Inter));
688 }
689 
FallbackScalingList4x4(int i,const int default_scaling_list_intra[],const int default_scaling_list_inter[],int scaling_list4x4[][kH264ScalingList4x4Length])690 static void FallbackScalingList4x4(
691     int i,
692     const int default_scaling_list_intra[],
693     const int default_scaling_list_inter[],
694     int scaling_list4x4[][kH264ScalingList4x4Length]) {
695   static const int kScalingList4x4ByteSize =
696       sizeof(scaling_list4x4[0][0]) * kH264ScalingList4x4Length;
697 
698   switch (i) {
699     case 0:
700       memcpy(scaling_list4x4[i], default_scaling_list_intra,
701              kScalingList4x4ByteSize);
702       break;
703 
704     case 1:
705       memcpy(scaling_list4x4[i], scaling_list4x4[0], kScalingList4x4ByteSize);
706       break;
707 
708     case 2:
709       memcpy(scaling_list4x4[i], scaling_list4x4[1], kScalingList4x4ByteSize);
710       break;
711 
712     case 3:
713       memcpy(scaling_list4x4[i], default_scaling_list_inter,
714              kScalingList4x4ByteSize);
715       break;
716 
717     case 4:
718       memcpy(scaling_list4x4[i], scaling_list4x4[3], kScalingList4x4ByteSize);
719       break;
720 
721     case 5:
722       memcpy(scaling_list4x4[i], scaling_list4x4[4], kScalingList4x4ByteSize);
723       break;
724 
725     default:
726       NOTREACHED();
727       break;
728   }
729 }
730 
FallbackScalingList8x8(int i,const int default_scaling_list_intra[],const int default_scaling_list_inter[],int scaling_list8x8[][kH264ScalingList8x8Length])731 static void FallbackScalingList8x8(
732     int i,
733     const int default_scaling_list_intra[],
734     const int default_scaling_list_inter[],
735     int scaling_list8x8[][kH264ScalingList8x8Length]) {
736   static const int kScalingList8x8ByteSize =
737       sizeof(scaling_list8x8[0][0]) * kH264ScalingList8x8Length;
738 
739   switch (i) {
740     case 0:
741       memcpy(scaling_list8x8[i], default_scaling_list_intra,
742              kScalingList8x8ByteSize);
743       break;
744 
745     case 1:
746       memcpy(scaling_list8x8[i], default_scaling_list_inter,
747              kScalingList8x8ByteSize);
748       break;
749 
750     case 2:
751       memcpy(scaling_list8x8[i], scaling_list8x8[0], kScalingList8x8ByteSize);
752       break;
753 
754     case 3:
755       memcpy(scaling_list8x8[i], scaling_list8x8[1], kScalingList8x8ByteSize);
756       break;
757 
758     case 4:
759       memcpy(scaling_list8x8[i], scaling_list8x8[2], kScalingList8x8ByteSize);
760       break;
761 
762     case 5:
763       memcpy(scaling_list8x8[i], scaling_list8x8[3], kScalingList8x8ByteSize);
764       break;
765 
766     default:
767       NOTREACHED();
768       break;
769   }
770 }
771 
ParseScalingList(int size,int * scaling_list,bool * use_default)772 H264Parser::Result H264Parser::ParseScalingList(int size,
773                                                 int* scaling_list,
774                                                 bool* use_default) {
775   // See chapter 7.3.2.1.1.1.
776   int last_scale = 8;
777   int next_scale = 8;
778   int delta_scale;
779 
780   *use_default = false;
781 
782   for (int j = 0; j < size; ++j) {
783     if (next_scale != 0) {
784       READ_SE_OR_RETURN(&delta_scale);
785       IN_RANGE_OR_RETURN(delta_scale, -128, 127);
786       next_scale = (last_scale + delta_scale + 256) & 0xff;
787 
788       if (j == 0 && next_scale == 0) {
789         *use_default = true;
790         return kOk;
791       }
792     }
793 
794     scaling_list[j] = (next_scale == 0) ? last_scale : next_scale;
795     last_scale = scaling_list[j];
796   }
797 
798   return kOk;
799 }
800 
ParseSPSScalingLists(H264SPS * sps)801 H264Parser::Result H264Parser::ParseSPSScalingLists(H264SPS* sps) {
802   // See 7.4.2.1.1.
803   bool seq_scaling_list_present_flag;
804   bool use_default;
805   Result res;
806 
807   // Parse scaling_list4x4.
808   for (int i = 0; i < 6; ++i) {
809     READ_BOOL_OR_RETURN(&seq_scaling_list_present_flag);
810 
811     if (seq_scaling_list_present_flag) {
812       res = ParseScalingList(base::size(sps->scaling_list4x4[i]),
813                              sps->scaling_list4x4[i], &use_default);
814       if (res != kOk)
815         return res;
816 
817       if (use_default)
818         DefaultScalingList4x4(i, sps->scaling_list4x4);
819 
820     } else {
821       FallbackScalingList4x4(i, kDefault4x4Intra, kDefault4x4Inter,
822                              sps->scaling_list4x4);
823     }
824   }
825 
826   // Parse scaling_list8x8.
827   for (int i = 0; i < ((sps->chroma_format_idc != 3) ? 2 : 6); ++i) {
828     READ_BOOL_OR_RETURN(&seq_scaling_list_present_flag);
829 
830     if (seq_scaling_list_present_flag) {
831       res = ParseScalingList(base::size(sps->scaling_list8x8[i]),
832                              sps->scaling_list8x8[i], &use_default);
833       if (res != kOk)
834         return res;
835 
836       if (use_default)
837         DefaultScalingList8x8(i, sps->scaling_list8x8);
838 
839     } else {
840       FallbackScalingList8x8(i, kDefault8x8Intra, kDefault8x8Inter,
841                              sps->scaling_list8x8);
842     }
843   }
844 
845   return kOk;
846 }
847 
ParsePPSScalingLists(const H264SPS & sps,H264PPS * pps)848 H264Parser::Result H264Parser::ParsePPSScalingLists(const H264SPS& sps,
849                                                     H264PPS* pps) {
850   // See 7.4.2.2.
851   bool pic_scaling_list_present_flag;
852   bool use_default;
853   Result res;
854 
855   for (int i = 0; i < 6; ++i) {
856     READ_BOOL_OR_RETURN(&pic_scaling_list_present_flag);
857 
858     if (pic_scaling_list_present_flag) {
859       res = ParseScalingList(base::size(pps->scaling_list4x4[i]),
860                              pps->scaling_list4x4[i], &use_default);
861       if (res != kOk)
862         return res;
863 
864       if (use_default)
865         DefaultScalingList4x4(i, pps->scaling_list4x4);
866 
867     } else {
868       if (!sps.seq_scaling_matrix_present_flag) {
869         // Table 7-2 fallback rule A in spec.
870         FallbackScalingList4x4(i, kDefault4x4Intra, kDefault4x4Inter,
871                                pps->scaling_list4x4);
872       } else {
873         // Table 7-2 fallback rule B in spec.
874         FallbackScalingList4x4(i, sps.scaling_list4x4[0],
875                                sps.scaling_list4x4[3], pps->scaling_list4x4);
876       }
877     }
878   }
879 
880   if (pps->transform_8x8_mode_flag) {
881     for (int i = 0; i < ((sps.chroma_format_idc != 3) ? 2 : 6); ++i) {
882       READ_BOOL_OR_RETURN(&pic_scaling_list_present_flag);
883 
884       if (pic_scaling_list_present_flag) {
885         res = ParseScalingList(base::size(pps->scaling_list8x8[i]),
886                                pps->scaling_list8x8[i], &use_default);
887         if (res != kOk)
888           return res;
889 
890         if (use_default)
891           DefaultScalingList8x8(i, pps->scaling_list8x8);
892 
893       } else {
894         if (!sps.seq_scaling_matrix_present_flag) {
895           // Table 7-2 fallback rule A in spec.
896           FallbackScalingList8x8(i, kDefault8x8Intra, kDefault8x8Inter,
897                                  pps->scaling_list8x8);
898         } else {
899           // Table 7-2 fallback rule B in spec.
900           FallbackScalingList8x8(i, sps.scaling_list8x8[0],
901                                  sps.scaling_list8x8[1], pps->scaling_list8x8);
902         }
903       }
904     }
905   }
906   return kOk;
907 }
908 
ParseAndIgnoreHRDParameters(bool * hrd_parameters_present)909 H264Parser::Result H264Parser::ParseAndIgnoreHRDParameters(
910     bool* hrd_parameters_present) {
911   int data;
912   READ_BOOL_OR_RETURN(&data);  // {nal,vcl}_hrd_parameters_present_flag
913   if (!data)
914     return kOk;
915 
916   *hrd_parameters_present = true;
917 
918   int cpb_cnt_minus1;
919   READ_UE_OR_RETURN(&cpb_cnt_minus1);
920   IN_RANGE_OR_RETURN(cpb_cnt_minus1, 0, 31);
921   READ_BITS_OR_RETURN(8, &data);  // bit_rate_scale, cpb_size_scale
922   for (int i = 0; i <= cpb_cnt_minus1; ++i) {
923     READ_UE_OR_RETURN(&data);    // bit_rate_value_minus1[i]
924     READ_UE_OR_RETURN(&data);    // cpb_size_value_minus1[i]
925     READ_BOOL_OR_RETURN(&data);  // cbr_flag
926   }
927   READ_BITS_OR_RETURN(20, &data);  // cpb/dpb delays, etc.
928 
929   return kOk;
930 }
931 
ParseVUIParameters(H264SPS * sps)932 H264Parser::Result H264Parser::ParseVUIParameters(H264SPS* sps) {
933   bool aspect_ratio_info_present_flag;
934   READ_BOOL_OR_RETURN(&aspect_ratio_info_present_flag);
935   if (aspect_ratio_info_present_flag) {
936     int aspect_ratio_idc;
937     READ_BITS_OR_RETURN(8, &aspect_ratio_idc);
938     if (aspect_ratio_idc == H264SPS::kExtendedSar) {
939       READ_BITS_OR_RETURN(16, &sps->sar_width);
940       READ_BITS_OR_RETURN(16, &sps->sar_height);
941     } else {
942       const int max_aspect_ratio_idc = base::size(kTableSarWidth) - 1;
943       IN_RANGE_OR_RETURN(aspect_ratio_idc, 0, max_aspect_ratio_idc);
944       sps->sar_width = kTableSarWidth[aspect_ratio_idc];
945       sps->sar_height = kTableSarHeight[aspect_ratio_idc];
946     }
947   }
948 
949   int data;
950   // Read and ignore overscan and video signal type info.
951   READ_BOOL_OR_RETURN(&data);  // overscan_info_present_flag
952   if (data)
953     READ_BOOL_OR_RETURN(&data);  // overscan_appropriate_flag
954 
955   READ_BOOL_OR_RETURN(&sps->video_signal_type_present_flag);
956   if (sps->video_signal_type_present_flag) {
957     READ_BITS_OR_RETURN(3, &sps->video_format);
958     READ_BOOL_OR_RETURN(&sps->video_full_range_flag);
959     READ_BOOL_OR_RETURN(&sps->colour_description_present_flag);
960     if (sps->colour_description_present_flag) {
961       // color description syntax elements
962       READ_BITS_OR_RETURN(8, &sps->colour_primaries);
963       READ_BITS_OR_RETURN(8, &sps->transfer_characteristics);
964       READ_BITS_OR_RETURN(8, &sps->matrix_coefficients);
965     }
966   }
967 
968   READ_BOOL_OR_RETURN(&data);  // chroma_loc_info_present_flag
969   if (data) {
970     READ_UE_OR_RETURN(&data);  // chroma_sample_loc_type_top_field
971     READ_UE_OR_RETURN(&data);  // chroma_sample_loc_type_bottom_field
972   }
973 
974   // Read and ignore timing info.
975   READ_BOOL_OR_RETURN(&data);  // timing_info_present_flag
976   if (data) {
977     READ_BITS_OR_RETURN(16, &data);  // num_units_in_tick
978     READ_BITS_OR_RETURN(16, &data);  // num_units_in_tick
979     READ_BITS_OR_RETURN(16, &data);  // time_scale
980     READ_BITS_OR_RETURN(16, &data);  // time_scale
981     READ_BOOL_OR_RETURN(&data);      // fixed_frame_rate_flag
982   }
983 
984   // Read and ignore NAL HRD parameters, if present.
985   bool hrd_parameters_present = false;
986   Result res = ParseAndIgnoreHRDParameters(&hrd_parameters_present);
987   if (res != kOk)
988     return res;
989 
990   // Read and ignore VCL HRD parameters, if present.
991   res = ParseAndIgnoreHRDParameters(&hrd_parameters_present);
992   if (res != kOk)
993     return res;
994 
995   if (hrd_parameters_present)    // One of NAL or VCL params present is enough.
996     READ_BOOL_OR_RETURN(&data);  // low_delay_hrd_flag
997 
998   READ_BOOL_OR_RETURN(&data);  // pic_struct_present_flag
999   READ_BOOL_OR_RETURN(&sps->bitstream_restriction_flag);
1000   if (sps->bitstream_restriction_flag) {
1001     READ_BOOL_OR_RETURN(&data);  // motion_vectors_over_pic_boundaries_flag
1002     READ_UE_OR_RETURN(&data);    // max_bytes_per_pic_denom
1003     READ_UE_OR_RETURN(&data);    // max_bits_per_mb_denom
1004     READ_UE_OR_RETURN(&data);    // log2_max_mv_length_horizontal
1005     READ_UE_OR_RETURN(&data);    // log2_max_mv_length_vertical
1006     READ_UE_OR_RETURN(&sps->max_num_reorder_frames);
1007     READ_UE_OR_RETURN(&sps->max_dec_frame_buffering);
1008     TRUE_OR_RETURN(sps->max_dec_frame_buffering >= sps->max_num_ref_frames);
1009     IN_RANGE_OR_RETURN(sps->max_num_reorder_frames, 0,
1010                        sps->max_dec_frame_buffering);
1011   }
1012 
1013   return kOk;
1014 }
1015 
FillDefaultSeqScalingLists(H264SPS * sps)1016 static void FillDefaultSeqScalingLists(H264SPS* sps) {
1017   for (int i = 0; i < 6; ++i)
1018     for (int j = 0; j < kH264ScalingList4x4Length; ++j)
1019       sps->scaling_list4x4[i][j] = 16;
1020 
1021   for (int i = 0; i < 6; ++i)
1022     for (int j = 0; j < kH264ScalingList8x8Length; ++j)
1023       sps->scaling_list8x8[i][j] = 16;
1024 }
1025 
ParseSPS(int * sps_id)1026 H264Parser::Result H264Parser::ParseSPS(int* sps_id) {
1027   // See 7.4.2.1.
1028   int data;
1029   Result res;
1030 
1031   *sps_id = -1;
1032 
1033   std::unique_ptr<H264SPS> sps(new H264SPS());
1034 
1035   READ_BITS_OR_RETURN(8, &sps->profile_idc);
1036   READ_BOOL_OR_RETURN(&sps->constraint_set0_flag);
1037   READ_BOOL_OR_RETURN(&sps->constraint_set1_flag);
1038   READ_BOOL_OR_RETURN(&sps->constraint_set2_flag);
1039   READ_BOOL_OR_RETURN(&sps->constraint_set3_flag);
1040   READ_BOOL_OR_RETURN(&sps->constraint_set4_flag);
1041   READ_BOOL_OR_RETURN(&sps->constraint_set5_flag);
1042   READ_BITS_OR_RETURN(2, &data);  // reserved_zero_2bits
1043   READ_BITS_OR_RETURN(8, &sps->level_idc);
1044   READ_UE_OR_RETURN(&sps->seq_parameter_set_id);
1045   TRUE_OR_RETURN(sps->seq_parameter_set_id < 32);
1046 
1047   if (sps->profile_idc == 100 || sps->profile_idc == 110 ||
1048       sps->profile_idc == 122 || sps->profile_idc == 244 ||
1049       sps->profile_idc == 44 || sps->profile_idc == 83 ||
1050       sps->profile_idc == 86 || sps->profile_idc == 118 ||
1051       sps->profile_idc == 128) {
1052     READ_UE_OR_RETURN(&sps->chroma_format_idc);
1053     TRUE_OR_RETURN(sps->chroma_format_idc < 4);
1054 
1055     if (sps->chroma_format_idc == 3)
1056       READ_BOOL_OR_RETURN(&sps->separate_colour_plane_flag);
1057 
1058     READ_UE_OR_RETURN(&sps->bit_depth_luma_minus8);
1059     TRUE_OR_RETURN(sps->bit_depth_luma_minus8 < 7);
1060 
1061     READ_UE_OR_RETURN(&sps->bit_depth_chroma_minus8);
1062     TRUE_OR_RETURN(sps->bit_depth_chroma_minus8 < 7);
1063 
1064     READ_BOOL_OR_RETURN(&sps->qpprime_y_zero_transform_bypass_flag);
1065     READ_BOOL_OR_RETURN(&sps->seq_scaling_matrix_present_flag);
1066 
1067     if (sps->seq_scaling_matrix_present_flag) {
1068       DVLOG(4) << "Scaling matrix present";
1069       res = ParseSPSScalingLists(sps.get());
1070       if (res != kOk)
1071         return res;
1072     } else {
1073       FillDefaultSeqScalingLists(sps.get());
1074     }
1075   } else {
1076     sps->chroma_format_idc = 1;
1077     FillDefaultSeqScalingLists(sps.get());
1078   }
1079 
1080   if (sps->separate_colour_plane_flag)
1081     sps->chroma_array_type = 0;
1082   else
1083     sps->chroma_array_type = sps->chroma_format_idc;
1084 
1085   READ_UE_OR_RETURN(&sps->log2_max_frame_num_minus4);
1086   TRUE_OR_RETURN(sps->log2_max_frame_num_minus4 < 13);
1087 
1088   READ_UE_OR_RETURN(&sps->pic_order_cnt_type);
1089   TRUE_OR_RETURN(sps->pic_order_cnt_type < 3);
1090 
1091   if (sps->pic_order_cnt_type == 0) {
1092     READ_UE_OR_RETURN(&sps->log2_max_pic_order_cnt_lsb_minus4);
1093     TRUE_OR_RETURN(sps->log2_max_pic_order_cnt_lsb_minus4 < 13);
1094     sps->expected_delta_per_pic_order_cnt_cycle = 0;
1095   } else if (sps->pic_order_cnt_type == 1) {
1096     READ_BOOL_OR_RETURN(&sps->delta_pic_order_always_zero_flag);
1097     READ_SE_OR_RETURN(&sps->offset_for_non_ref_pic);
1098     READ_SE_OR_RETURN(&sps->offset_for_top_to_bottom_field);
1099     READ_UE_OR_RETURN(&sps->num_ref_frames_in_pic_order_cnt_cycle);
1100     TRUE_OR_RETURN(sps->num_ref_frames_in_pic_order_cnt_cycle < 255);
1101 
1102     base::CheckedNumeric<int> offset_acc = 0;
1103     for (int i = 0; i < sps->num_ref_frames_in_pic_order_cnt_cycle; ++i) {
1104       READ_SE_OR_RETURN(&sps->offset_for_ref_frame[i]);
1105       offset_acc += sps->offset_for_ref_frame[i];
1106     }
1107     if (!offset_acc.IsValid())
1108       return kInvalidStream;
1109     sps->expected_delta_per_pic_order_cnt_cycle = offset_acc.ValueOrDefault(0);
1110   }
1111 
1112   READ_UE_OR_RETURN(&sps->max_num_ref_frames);
1113   READ_BOOL_OR_RETURN(&sps->gaps_in_frame_num_value_allowed_flag);
1114 
1115   READ_UE_OR_RETURN(&sps->pic_width_in_mbs_minus1);
1116   READ_UE_OR_RETURN(&sps->pic_height_in_map_units_minus1);
1117 
1118   READ_BOOL_OR_RETURN(&sps->frame_mbs_only_flag);
1119   if (!sps->frame_mbs_only_flag)
1120     READ_BOOL_OR_RETURN(&sps->mb_adaptive_frame_field_flag);
1121 
1122   READ_BOOL_OR_RETURN(&sps->direct_8x8_inference_flag);
1123 
1124   READ_BOOL_OR_RETURN(&sps->frame_cropping_flag);
1125   if (sps->frame_cropping_flag) {
1126     READ_UE_OR_RETURN(&sps->frame_crop_left_offset);
1127     READ_UE_OR_RETURN(&sps->frame_crop_right_offset);
1128     READ_UE_OR_RETURN(&sps->frame_crop_top_offset);
1129     READ_UE_OR_RETURN(&sps->frame_crop_bottom_offset);
1130   }
1131 
1132   READ_BOOL_OR_RETURN(&sps->vui_parameters_present_flag);
1133   if (sps->vui_parameters_present_flag) {
1134     DVLOG(4) << "VUI parameters present";
1135     res = ParseVUIParameters(sps.get());
1136     if (res != kOk)
1137       return res;
1138   }
1139 
1140   // If an SPS with the same id already exists, replace it.
1141   *sps_id = sps->seq_parameter_set_id;
1142   active_SPSes_[*sps_id] = std::move(sps);
1143 
1144   return kOk;
1145 }
1146 
ParsePPS(int * pps_id)1147 H264Parser::Result H264Parser::ParsePPS(int* pps_id) {
1148   // See 7.4.2.2.
1149   const H264SPS* sps;
1150   Result res;
1151 
1152   *pps_id = -1;
1153 
1154   std::unique_ptr<H264PPS> pps(new H264PPS());
1155 
1156   READ_UE_OR_RETURN(&pps->pic_parameter_set_id);
1157   READ_UE_OR_RETURN(&pps->seq_parameter_set_id);
1158   TRUE_OR_RETURN(pps->seq_parameter_set_id < 32);
1159 
1160   if (active_SPSes_.find(pps->seq_parameter_set_id) == active_SPSes_.end()) {
1161     DVLOG(1) << "Invalid stream, no SPS id: " << pps->seq_parameter_set_id;
1162     return kInvalidStream;
1163   }
1164 
1165   sps = GetSPS(pps->seq_parameter_set_id);
1166   TRUE_OR_RETURN(sps);
1167 
1168   READ_BOOL_OR_RETURN(&pps->entropy_coding_mode_flag);
1169   READ_BOOL_OR_RETURN(&pps->bottom_field_pic_order_in_frame_present_flag);
1170 
1171   READ_UE_OR_RETURN(&pps->num_slice_groups_minus1);
1172   if (pps->num_slice_groups_minus1 > 1) {
1173     DVLOG(1) << "Slice groups not supported";
1174     return kUnsupportedStream;
1175   }
1176 
1177   READ_UE_OR_RETURN(&pps->num_ref_idx_l0_default_active_minus1);
1178   TRUE_OR_RETURN(pps->num_ref_idx_l0_default_active_minus1 < 32);
1179 
1180   READ_UE_OR_RETURN(&pps->num_ref_idx_l1_default_active_minus1);
1181   TRUE_OR_RETURN(pps->num_ref_idx_l1_default_active_minus1 < 32);
1182 
1183   READ_BOOL_OR_RETURN(&pps->weighted_pred_flag);
1184   READ_BITS_OR_RETURN(2, &pps->weighted_bipred_idc);
1185   TRUE_OR_RETURN(pps->weighted_bipred_idc < 3);
1186 
1187   READ_SE_OR_RETURN(&pps->pic_init_qp_minus26);
1188   IN_RANGE_OR_RETURN(pps->pic_init_qp_minus26, -26, 25);
1189 
1190   READ_SE_OR_RETURN(&pps->pic_init_qs_minus26);
1191   IN_RANGE_OR_RETURN(pps->pic_init_qs_minus26, -26, 25);
1192 
1193   READ_SE_OR_RETURN(&pps->chroma_qp_index_offset);
1194   IN_RANGE_OR_RETURN(pps->chroma_qp_index_offset, -12, 12);
1195   pps->second_chroma_qp_index_offset = pps->chroma_qp_index_offset;
1196 
1197   READ_BOOL_OR_RETURN(&pps->deblocking_filter_control_present_flag);
1198   READ_BOOL_OR_RETURN(&pps->constrained_intra_pred_flag);
1199   READ_BOOL_OR_RETURN(&pps->redundant_pic_cnt_present_flag);
1200 
1201   if (br_.HasMoreRBSPData()) {
1202     READ_BOOL_OR_RETURN(&pps->transform_8x8_mode_flag);
1203     READ_BOOL_OR_RETURN(&pps->pic_scaling_matrix_present_flag);
1204 
1205     if (pps->pic_scaling_matrix_present_flag) {
1206       DVLOG(4) << "Picture scaling matrix present";
1207       res = ParsePPSScalingLists(*sps, pps.get());
1208       if (res != kOk)
1209         return res;
1210     }
1211 
1212     READ_SE_OR_RETURN(&pps->second_chroma_qp_index_offset);
1213   }
1214 
1215   // If a PPS with the same id already exists, replace it.
1216   *pps_id = pps->pic_parameter_set_id;
1217   active_PPSes_[*pps_id] = std::move(pps);
1218 
1219   return kOk;
1220 }
1221 
ParseSPSExt(int * sps_id)1222 H264Parser::Result H264Parser::ParseSPSExt(int* sps_id) {
1223   // See 7.4.2.1.
1224   int local_sps_id = -1;
1225 
1226   *sps_id = -1;
1227 
1228   READ_UE_OR_RETURN(&local_sps_id);
1229   TRUE_OR_RETURN(local_sps_id < 32);
1230 
1231   *sps_id = local_sps_id;
1232   return kOk;
1233 }
1234 
ParseRefPicListModification(int num_ref_idx_active_minus1,H264ModificationOfPicNum * ref_list_mods)1235 H264Parser::Result H264Parser::ParseRefPicListModification(
1236     int num_ref_idx_active_minus1,
1237     H264ModificationOfPicNum* ref_list_mods) {
1238   H264ModificationOfPicNum* pic_num_mod;
1239 
1240   if (num_ref_idx_active_minus1 >= 32)
1241     return kInvalidStream;
1242 
1243   for (int i = 0; i < 32; ++i) {
1244     pic_num_mod = &ref_list_mods[i];
1245     READ_UE_OR_RETURN(&pic_num_mod->modification_of_pic_nums_idc);
1246     TRUE_OR_RETURN(pic_num_mod->modification_of_pic_nums_idc < 4);
1247 
1248     switch (pic_num_mod->modification_of_pic_nums_idc) {
1249       case 0:
1250       case 1:
1251         READ_UE_OR_RETURN(&pic_num_mod->abs_diff_pic_num_minus1);
1252         break;
1253 
1254       case 2:
1255         READ_UE_OR_RETURN(&pic_num_mod->long_term_pic_num);
1256         break;
1257 
1258       case 3:
1259         // Per spec, list cannot be empty.
1260         if (i == 0)
1261           return kInvalidStream;
1262         return kOk;
1263 
1264       default:
1265         return kInvalidStream;
1266     }
1267   }
1268 
1269   // If we got here, we didn't get loop end marker prematurely,
1270   // so make sure it is there for our client.
1271   int modification_of_pic_nums_idc;
1272   READ_UE_OR_RETURN(&modification_of_pic_nums_idc);
1273   TRUE_OR_RETURN(modification_of_pic_nums_idc == 3);
1274 
1275   return kOk;
1276 }
1277 
ParseRefPicListModifications(H264SliceHeader * shdr)1278 H264Parser::Result H264Parser::ParseRefPicListModifications(
1279     H264SliceHeader* shdr) {
1280   Result res;
1281 
1282   if (!shdr->IsISlice() && !shdr->IsSISlice()) {
1283     READ_BOOL_OR_RETURN(&shdr->ref_pic_list_modification_flag_l0);
1284     if (shdr->ref_pic_list_modification_flag_l0) {
1285       res = ParseRefPicListModification(shdr->num_ref_idx_l0_active_minus1,
1286                                         shdr->ref_list_l0_modifications);
1287       if (res != kOk)
1288         return res;
1289     }
1290   }
1291 
1292   if (shdr->IsBSlice()) {
1293     READ_BOOL_OR_RETURN(&shdr->ref_pic_list_modification_flag_l1);
1294     if (shdr->ref_pic_list_modification_flag_l1) {
1295       res = ParseRefPicListModification(shdr->num_ref_idx_l1_active_minus1,
1296                                         shdr->ref_list_l1_modifications);
1297       if (res != kOk)
1298         return res;
1299     }
1300   }
1301 
1302   return kOk;
1303 }
1304 
ParseWeightingFactors(int num_ref_idx_active_minus1,int chroma_array_type,int luma_log2_weight_denom,int chroma_log2_weight_denom,H264WeightingFactors * w_facts)1305 H264Parser::Result H264Parser::ParseWeightingFactors(
1306     int num_ref_idx_active_minus1,
1307     int chroma_array_type,
1308     int luma_log2_weight_denom,
1309     int chroma_log2_weight_denom,
1310     H264WeightingFactors* w_facts) {
1311   int def_luma_weight = 1 << luma_log2_weight_denom;
1312   int def_chroma_weight = 1 << chroma_log2_weight_denom;
1313 
1314   for (int i = 0; i < num_ref_idx_active_minus1 + 1; ++i) {
1315     READ_BOOL_OR_RETURN(&w_facts->luma_weight_flag);
1316     if (w_facts->luma_weight_flag) {
1317       READ_SE_OR_RETURN(&w_facts->luma_weight[i]);
1318       IN_RANGE_OR_RETURN(w_facts->luma_weight[i], -128, 127);
1319 
1320       READ_SE_OR_RETURN(&w_facts->luma_offset[i]);
1321       IN_RANGE_OR_RETURN(w_facts->luma_offset[i], -128, 127);
1322     } else {
1323       w_facts->luma_weight[i] = def_luma_weight;
1324       w_facts->luma_offset[i] = 0;
1325     }
1326 
1327     if (chroma_array_type != 0) {
1328       READ_BOOL_OR_RETURN(&w_facts->chroma_weight_flag);
1329       if (w_facts->chroma_weight_flag) {
1330         for (int j = 0; j < 2; ++j) {
1331           READ_SE_OR_RETURN(&w_facts->chroma_weight[i][j]);
1332           IN_RANGE_OR_RETURN(w_facts->chroma_weight[i][j], -128, 127);
1333 
1334           READ_SE_OR_RETURN(&w_facts->chroma_offset[i][j]);
1335           IN_RANGE_OR_RETURN(w_facts->chroma_offset[i][j], -128, 127);
1336         }
1337       } else {
1338         for (int j = 0; j < 2; ++j) {
1339           w_facts->chroma_weight[i][j] = def_chroma_weight;
1340           w_facts->chroma_offset[i][j] = 0;
1341         }
1342       }
1343     }
1344   }
1345 
1346   return kOk;
1347 }
1348 
ParsePredWeightTable(const H264SPS & sps,H264SliceHeader * shdr)1349 H264Parser::Result H264Parser::ParsePredWeightTable(const H264SPS& sps,
1350                                                     H264SliceHeader* shdr) {
1351   READ_UE_OR_RETURN(&shdr->luma_log2_weight_denom);
1352   TRUE_OR_RETURN(shdr->luma_log2_weight_denom < 8);
1353 
1354   if (sps.chroma_array_type != 0)
1355     READ_UE_OR_RETURN(&shdr->chroma_log2_weight_denom);
1356   TRUE_OR_RETURN(shdr->chroma_log2_weight_denom < 8);
1357 
1358   Result res = ParseWeightingFactors(
1359       shdr->num_ref_idx_l0_active_minus1, sps.chroma_array_type,
1360       shdr->luma_log2_weight_denom, shdr->chroma_log2_weight_denom,
1361       &shdr->pred_weight_table_l0);
1362   if (res != kOk)
1363     return res;
1364 
1365   if (shdr->IsBSlice()) {
1366     res = ParseWeightingFactors(
1367         shdr->num_ref_idx_l1_active_minus1, sps.chroma_array_type,
1368         shdr->luma_log2_weight_denom, shdr->chroma_log2_weight_denom,
1369         &shdr->pred_weight_table_l1);
1370     if (res != kOk)
1371       return res;
1372   }
1373 
1374   return kOk;
1375 }
1376 
ParseDecRefPicMarking(H264SliceHeader * shdr)1377 H264Parser::Result H264Parser::ParseDecRefPicMarking(H264SliceHeader* shdr) {
1378   size_t bits_left_at_start = br_.NumBitsLeft();
1379 
1380   if (shdr->idr_pic_flag) {
1381     READ_BOOL_OR_RETURN(&shdr->no_output_of_prior_pics_flag);
1382     READ_BOOL_OR_RETURN(&shdr->long_term_reference_flag);
1383   } else {
1384     READ_BOOL_OR_RETURN(&shdr->adaptive_ref_pic_marking_mode_flag);
1385 
1386     H264DecRefPicMarking* marking;
1387     if (shdr->adaptive_ref_pic_marking_mode_flag) {
1388       size_t i;
1389       for (i = 0; i < base::size(shdr->ref_pic_marking); ++i) {
1390         marking = &shdr->ref_pic_marking[i];
1391 
1392         READ_UE_OR_RETURN(&marking->memory_mgmnt_control_operation);
1393         if (marking->memory_mgmnt_control_operation == 0)
1394           break;
1395 
1396         if (marking->memory_mgmnt_control_operation == 1 ||
1397             marking->memory_mgmnt_control_operation == 3)
1398           READ_UE_OR_RETURN(&marking->difference_of_pic_nums_minus1);
1399 
1400         if (marking->memory_mgmnt_control_operation == 2)
1401           READ_UE_OR_RETURN(&marking->long_term_pic_num);
1402 
1403         if (marking->memory_mgmnt_control_operation == 3 ||
1404             marking->memory_mgmnt_control_operation == 6)
1405           READ_UE_OR_RETURN(&marking->long_term_frame_idx);
1406 
1407         if (marking->memory_mgmnt_control_operation == 4)
1408           READ_UE_OR_RETURN(&marking->max_long_term_frame_idx_plus1);
1409 
1410         if (marking->memory_mgmnt_control_operation > 6)
1411           return kInvalidStream;
1412       }
1413 
1414       if (i == base::size(shdr->ref_pic_marking)) {
1415         DVLOG(1) << "Ran out of dec ref pic marking fields";
1416         return kUnsupportedStream;
1417       }
1418     }
1419   }
1420 
1421   shdr->dec_ref_pic_marking_bit_size = bits_left_at_start - br_.NumBitsLeft();
1422   return kOk;
1423 }
1424 
ParseSliceHeader(const H264NALU & nalu,H264SliceHeader * shdr)1425 H264Parser::Result H264Parser::ParseSliceHeader(const H264NALU& nalu,
1426                                                 H264SliceHeader* shdr) {
1427   // See 7.4.3.
1428   const H264SPS* sps;
1429   const H264PPS* pps;
1430   Result res;
1431 
1432   memset(shdr, 0, sizeof(*shdr));
1433 
1434   shdr->idr_pic_flag = (nalu.nal_unit_type == 5);
1435   shdr->nal_ref_idc = nalu.nal_ref_idc;
1436   shdr->nalu_data = nalu.data;
1437   shdr->nalu_size = nalu.size;
1438 
1439   READ_UE_OR_RETURN(&shdr->first_mb_in_slice);
1440   READ_UE_OR_RETURN(&shdr->slice_type);
1441   TRUE_OR_RETURN(shdr->slice_type < 10);
1442 
1443   READ_UE_OR_RETURN(&shdr->pic_parameter_set_id);
1444 
1445   pps = GetPPS(shdr->pic_parameter_set_id);
1446   TRUE_OR_RETURN(pps);
1447 
1448   sps = GetSPS(pps->seq_parameter_set_id);
1449   TRUE_OR_RETURN(sps);
1450 
1451   if (sps->separate_colour_plane_flag) {
1452     DVLOG(1) << "Interlaced streams not supported";
1453     return kUnsupportedStream;
1454   }
1455 
1456   READ_BITS_OR_RETURN(sps->log2_max_frame_num_minus4 + 4, &shdr->frame_num);
1457   if (!sps->frame_mbs_only_flag) {
1458     READ_BOOL_OR_RETURN(&shdr->field_pic_flag);
1459     if (shdr->field_pic_flag) {
1460       DVLOG(1) << "Interlaced streams not supported";
1461       return kUnsupportedStream;
1462     }
1463   }
1464 
1465   if (shdr->idr_pic_flag)
1466     READ_UE_OR_RETURN(&shdr->idr_pic_id);
1467 
1468   size_t bits_left_at_pic_order_cnt_start = br_.NumBitsLeft();
1469   if (sps->pic_order_cnt_type == 0) {
1470     READ_BITS_OR_RETURN(sps->log2_max_pic_order_cnt_lsb_minus4 + 4,
1471                         &shdr->pic_order_cnt_lsb);
1472     if (pps->bottom_field_pic_order_in_frame_present_flag &&
1473         !shdr->field_pic_flag)
1474       READ_SE_OR_RETURN(&shdr->delta_pic_order_cnt_bottom);
1475   }
1476 
1477   if (sps->pic_order_cnt_type == 1 && !sps->delta_pic_order_always_zero_flag) {
1478     READ_SE_OR_RETURN(&shdr->delta_pic_order_cnt0);
1479     if (pps->bottom_field_pic_order_in_frame_present_flag &&
1480         !shdr->field_pic_flag)
1481       READ_SE_OR_RETURN(&shdr->delta_pic_order_cnt1);
1482   }
1483 
1484   shdr->pic_order_cnt_bit_size =
1485       bits_left_at_pic_order_cnt_start - br_.NumBitsLeft();
1486 
1487   if (pps->redundant_pic_cnt_present_flag) {
1488     READ_UE_OR_RETURN(&shdr->redundant_pic_cnt);
1489     TRUE_OR_RETURN(shdr->redundant_pic_cnt < 128);
1490   }
1491 
1492   if (shdr->IsBSlice())
1493     READ_BOOL_OR_RETURN(&shdr->direct_spatial_mv_pred_flag);
1494 
1495   if (shdr->IsPSlice() || shdr->IsSPSlice() || shdr->IsBSlice()) {
1496     READ_BOOL_OR_RETURN(&shdr->num_ref_idx_active_override_flag);
1497     if (shdr->num_ref_idx_active_override_flag) {
1498       READ_UE_OR_RETURN(&shdr->num_ref_idx_l0_active_minus1);
1499       if (shdr->IsBSlice())
1500         READ_UE_OR_RETURN(&shdr->num_ref_idx_l1_active_minus1);
1501     } else {
1502       shdr->num_ref_idx_l0_active_minus1 =
1503           pps->num_ref_idx_l0_default_active_minus1;
1504       if (shdr->IsBSlice()) {
1505         shdr->num_ref_idx_l1_active_minus1 =
1506             pps->num_ref_idx_l1_default_active_minus1;
1507       }
1508     }
1509   }
1510   if (shdr->field_pic_flag) {
1511     TRUE_OR_RETURN(shdr->num_ref_idx_l0_active_minus1 < 32);
1512     TRUE_OR_RETURN(shdr->num_ref_idx_l1_active_minus1 < 32);
1513   } else {
1514     TRUE_OR_RETURN(shdr->num_ref_idx_l0_active_minus1 < 16);
1515     TRUE_OR_RETURN(shdr->num_ref_idx_l1_active_minus1 < 16);
1516   }
1517 
1518   if (nalu.nal_unit_type == H264NALU::kCodedSliceExtension) {
1519     return kUnsupportedStream;
1520   } else {
1521     res = ParseRefPicListModifications(shdr);
1522     if (res != kOk)
1523       return res;
1524   }
1525 
1526   if ((pps->weighted_pred_flag && (shdr->IsPSlice() || shdr->IsSPSlice())) ||
1527       (pps->weighted_bipred_idc == 1 && shdr->IsBSlice())) {
1528     res = ParsePredWeightTable(*sps, shdr);
1529     if (res != kOk)
1530       return res;
1531   }
1532 
1533   if (nalu.nal_ref_idc != 0) {
1534     res = ParseDecRefPicMarking(shdr);
1535     if (res != kOk)
1536       return res;
1537   }
1538 
1539   if (pps->entropy_coding_mode_flag && !shdr->IsISlice() &&
1540       !shdr->IsSISlice()) {
1541     READ_UE_OR_RETURN(&shdr->cabac_init_idc);
1542     TRUE_OR_RETURN(shdr->cabac_init_idc < 3);
1543   }
1544 
1545   READ_SE_OR_RETURN(&shdr->slice_qp_delta);
1546 
1547   if (shdr->IsSPSlice() || shdr->IsSISlice()) {
1548     if (shdr->IsSPSlice())
1549       READ_BOOL_OR_RETURN(&shdr->sp_for_switch_flag);
1550     READ_SE_OR_RETURN(&shdr->slice_qs_delta);
1551   }
1552 
1553   if (pps->deblocking_filter_control_present_flag) {
1554     READ_UE_OR_RETURN(&shdr->disable_deblocking_filter_idc);
1555     TRUE_OR_RETURN(shdr->disable_deblocking_filter_idc < 3);
1556 
1557     if (shdr->disable_deblocking_filter_idc != 1) {
1558       READ_SE_OR_RETURN(&shdr->slice_alpha_c0_offset_div2);
1559       IN_RANGE_OR_RETURN(shdr->slice_alpha_c0_offset_div2, -6, 6);
1560 
1561       READ_SE_OR_RETURN(&shdr->slice_beta_offset_div2);
1562       IN_RANGE_OR_RETURN(shdr->slice_beta_offset_div2, -6, 6);
1563     }
1564   }
1565 
1566   if (pps->num_slice_groups_minus1 > 0) {
1567     DVLOG(1) << "Slice groups not supported";
1568     return kUnsupportedStream;
1569   }
1570 
1571   size_t epb = br_.NumEmulationPreventionBytesRead();
1572   shdr->header_bit_size = (shdr->nalu_size - epb) * 8 - br_.NumBitsLeft();
1573 
1574   return kOk;
1575 }
1576 
ParseSEI(H264SEIMessage * sei_msg)1577 H264Parser::Result H264Parser::ParseSEI(H264SEIMessage* sei_msg) {
1578   int byte;
1579 
1580   memset(sei_msg, 0, sizeof(*sei_msg));
1581 
1582   READ_BITS_OR_RETURN(8, &byte);
1583   while (byte == 0xff) {
1584     sei_msg->type += 255;
1585     READ_BITS_OR_RETURN(8, &byte);
1586   }
1587   sei_msg->type += byte;
1588 
1589   READ_BITS_OR_RETURN(8, &byte);
1590   while (byte == 0xff) {
1591     sei_msg->payload_size += 255;
1592     READ_BITS_OR_RETURN(8, &byte);
1593   }
1594   sei_msg->payload_size += byte;
1595 
1596   DVLOG(4) << "Found SEI message type: " << sei_msg->type
1597            << " payload size: " << sei_msg->payload_size;
1598 
1599   switch (sei_msg->type) {
1600     case H264SEIMessage::kSEIRecoveryPoint:
1601       READ_UE_OR_RETURN(&sei_msg->recovery_point.recovery_frame_cnt);
1602       READ_BOOL_OR_RETURN(&sei_msg->recovery_point.exact_match_flag);
1603       READ_BOOL_OR_RETURN(&sei_msg->recovery_point.broken_link_flag);
1604       READ_BITS_OR_RETURN(2, &sei_msg->recovery_point.changing_slice_group_idc);
1605       break;
1606 
1607     default:
1608       DVLOG(4) << "Unsupported SEI message";
1609       break;
1610   }
1611 
1612   return kOk;
1613 }
1614 
GetCurrentSubsamples()1615 std::vector<SubsampleEntry> H264Parser::GetCurrentSubsamples() {
1616   DCHECK_EQ(previous_nalu_range_.size(), 1u)
1617       << "This should only be called after a "
1618          "successful call to AdvanceToNextNalu()";
1619 
1620   auto intersection = encrypted_ranges_.IntersectionWith(previous_nalu_range_);
1621   return EncryptedRangesToSubsampleEntry(
1622       previous_nalu_range_.start(0), previous_nalu_range_.end(0), intersection);
1623 }
1624 
1625 }  // namespace media
1626