From 98144696139aafad86f63a776e147e989731f43e Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Fri, 13 Nov 2026 07:24:13 +0000 Subject: [PATCH] Bound extreme H264 POC cycle arithmetic --- crates/video/src/h264/decode/slice.rs | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/crates/video/src/h264/decode/slice.rs b/crates/video/src/h264/decode/slice.rs index 32366ccf9..874c575ca 100644 --- a/crates/video/src/h264/decode/slice.rs +++ b/crates/video/src/h264/decode/slice.rs @@ -485,16 +485,18 @@ impl PocState { let cycle_cnt = (abs_frame_num - 1) / n; let in_cycle = (abs_frame_num - 1) % n; let delta_cycle = sps.offset_for_ref_frame.iter().map(|&o| i64::from(o)).sum::(); - expected = cycle_cnt * delta_cycle; + expected = cycle_cnt.saturating_mul(delta_cycle); for &o in &sps.offset_for_ref_frame[..=in_cycle as usize] { - expected += i64::from(o); + expected = expected.saturating_add(i64::from(o)); } } if sh.nal_ref_idc == 0 { - expected += i64::from(sps.offset_for_non_ref_pic); + expected = expected.saturating_add(i64::from(sps.offset_for_non_ref_pic)); } - let top = (expected + i64::from(sh.delta_pic_order_cnt[0])).clamp(i64::from(i32::MIN), i64::from(i32::MAX)) as i32; - let bottom = (i64::from(top) + i64::from(sps.offset_for_top_to_bottom_field) + i64::from(sh.delta_pic_order_cnt[1])) + let top = expected.saturating_add(i64::from(sh.delta_pic_order_cnt[0])).clamp(i64::from(i32::MIN), i64::from(i32::MAX)) as i32; + let bottom = i64::from(top) + .saturating_add(i64::from(sps.offset_for_top_to_bottom_field)) + .saturating_add(i64::from(sh.delta_pic_order_cnt[1])) .clamp(i64::from(i32::MIN), i64::from(i32::MAX)) as i32; Poc { top, bottom, msb: 0, frame_num_offset } } @@ -672,4 +674,14 @@ mod poc_tests { let poc = state.compute(&sh, &sps); assert_eq!(poc.top, i32::MAX); } + + #[test] + fn poc_type1_saturates_only_after_wide_cycle_arithmetic_exceeds_i64() { + let mut sps = sps(1); + sps.offset_for_ref_frame = vec![i32::MAX; 255]; + let sh = header(u32::MAX, 0, 0, [0, 0], 1); + let state = PocState { prev_frame_num_offset: i32::MAX, ..PocState::default() }; + let poc = state.compute(&sh, &sps); + assert_eq!(poc.top, i32::MAX); + } }