H.264 decoder crash

Harry · ‎05-31-2016

Hi,

In IPP H.264 decoder in file umc_h264_bitstream_inlines.h there is a macros:

#define RefreshCABACBits(codOffset, pBits, iBits) \
{ \
    Ipp16u *pRealPointer; \
    /* we have to handle the bit pointer very thorougly. */ \
    /* this sophisticated logic is used to avoid compilers' warnings. */ \
    /* In two words we just select required word by the pointer */ \
    pRealPointer = (Ipp16u *) (((Ipp8u *) 0) + \
                               ((((Ipp8u *) pBits) - (Ipp8u *) 0) ^ 2)); \
    codOffset |= *(pRealPointer) << (-iBits); \
    pBits += 1; \
    iBits += 16; \
}

When input data for decoding are incorrect, here maybe an incorrect value of pBits. And in such a case program is terminated. Are there a way to check is pBits correct? I think this problem maybe solved by additional checks when we allocate memory for data buffer. But how to do this check? What code I need to add?

Thanks.