From a7306ad85c7537136a1c95444cf50acc9956268b Mon Sep 17 00:00:00 2001
From: Jean-Yves Avenard <jyavenard@mozilla.com>
Date: Tue, 17 Mar 2015 16:42:02 +1100
Subject: [PATCH] Bug 1143516: Ignore SPS's aspect ratio if value is
 nonsensical. r=cpearce

---
 dom/media/fmp4/AVCCDecoderModule.cpp          |  1 +
 media/libstagefright/binding/H264.cpp         | 23 +++++++++++++++++++
 .../binding/include/mp4_demuxer/H264.h        |  3 +++
 3 files changed, 27 insertions(+)

diff --git a/dom/media/fmp4/AVCCDecoderModule.cpp b/dom/media/fmp4/AVCCDecoderModule.cpp
index cb366997cd8..b485285b586 100644
--- a/dom/media/fmp4/AVCCDecoderModule.cpp
+++ b/dom/media/fmp4/AVCCDecoderModule.cpp
@@ -238,6 +238,7 @@ AVCCMediaDataDecoder::UpdateConfigFromExtraData(mp4_demuxer::ByteBuffer* aExtraD
   mp4_demuxer::SPSData spsdata;
   if (mp4_demuxer::H264::DecodeSPSFromExtraData(aExtraData, spsdata) &&
       spsdata.pic_width > 0 && spsdata.pic_height > 0) {
+    mp4_demuxer::H264::EnsureSPSIsSane(spsdata);
     mCurrentConfig.image_width = spsdata.pic_width;
     mCurrentConfig.image_height = spsdata.pic_height;
     mCurrentConfig.display_width = spsdata.display_width;
diff --git a/media/libstagefright/binding/H264.cpp b/media/libstagefright/binding/H264.cpp
index 9cfc1891146..450356c1b33 100644
--- a/media/libstagefright/binding/H264.cpp
+++ b/media/libstagefright/binding/H264.cpp
@@ -480,4 +480,27 @@ H264::DecodeSPSFromExtraData(const ByteBuffer* aExtraData, SPSData& aDest)
   return DecodeSPS(sps, aDest);
 }
 
+/* static */ bool
+H264::EnsureSPSIsSane(SPSData& aSPS)
+{
+  bool valid = true;
+  static const float default_aspect = 4.0f / 3.0f;
+  if (aSPS.sample_ratio <= 0.0f || aSPS.sample_ratio > 6.0f) {
+    if (aSPS.pic_width && aSPS.pic_height) {
+      aSPS.sample_ratio =
+        (float) aSPS.pic_width / (float) aSPS.pic_height;
+    } else {
+      aSPS.sample_ratio = default_aspect;
+    }
+    aSPS.display_width = aSPS.pic_width;
+    aSPS.display_height = aSPS.pic_height;
+    valid = false;
+  }
+  if (aSPS.max_num_ref_frames > 16) {
+    aSPS.max_num_ref_frames = 16;
+    valid = false;
+  }
+  return valid;
+}
+
 } // namespace mp4_demuxer
diff --git a/media/libstagefright/binding/include/mp4_demuxer/H264.h b/media/libstagefright/binding/include/mp4_demuxer/H264.h
index b2dcad990f9..9122bfa82a3 100644
--- a/media/libstagefright/binding/include/mp4_demuxer/H264.h
+++ b/media/libstagefright/binding/include/mp4_demuxer/H264.h
@@ -325,6 +325,9 @@ public:
   static already_AddRefed<ByteBuffer> DecodeNALUnit(const ByteBuffer* aNAL);
   /* Decode SPS NAL RBSP and fill SPSData structure */
   static bool DecodeSPS(const ByteBuffer* aSPS, SPSData& aDest);
+  // Ensure that SPS data makes sense, Return true if SPS data was, and false
+  // otherwise. If false, then content will be adjusted accordingly.
+  static bool EnsureSPSIsSane(SPSData& aSPS);
 
 private:
   static void vui_parameters(BitReader& aBr, SPSData& aDest);