wrapper/libavc-mirror
1
0
Fork 0
mirror of https://github.com/ittiam-systems/libavc.git synced 2026-10-02 08:42:41 +07:00
Code Issues Projects Releases Packages Wiki Activity Actions

mvc: added check for incorrect abs_diff_pic_num_minus1

Browse source 
Bug: 242723830
Test: fuzzer poc in bug
Change-Id: Ic5190ac52aa2fe145f9b7a7cbaaf5c460a7fbd01
This commit is contained in:
Ashwin Natesan 2022-09-05 13:55:45 +05:30
parent 9c75f6b991
commit d2f8ae1661
No known key found for this signature in database
GPG key ID: F9C8103B9094CF1A
1 changed files with 10 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
decoder/mvc/imvcd_dpb_manager.c
View file

@ -1154,14 +1154,22 @@ WORD32 imvcd_dpb_reorder_ref_pic_list(mvc_dpb_manager_t *ps_dpb_mgr,
if((0 == pu1_modification_of_pic_nums_idc[0]) ||
(1 == pu1_modification_of_pic_nums_idc[0]))
{
WORD32 i4_mod_pic_num = 1 + pi4_abs_diff_pic_num_minus1[0];
WORD32 i4_mod_pic_num = pi4_abs_diff_pic_num_minus1[0];
UWORD8 u1_mod_buf_idx = u1_num_ref_bufs;
if(pi4_abs_diff_pic_num_minus1[0] > i4_max_pic_num)
/* According to section 7.4.3.1 from spec, */
/* this value is expected to be from the */
/* closed interval [0, i4_max_pic_num - 1] */
if((i4_mod_pic_num < 0) || (i4_mod_pic_num >= i4_max_pic_num))
{
return ERROR_DBP_MANAGER_T;
}
/* +1 not accounted during initialisation, */
/* mainly to preclude integer overflow */
i4_mod_pic_num++;
if(0 == pu1_modification_of_pic_nums_idc[0])
{
i4_mod_pic_num = i4_pred_pic_num - i4_mod_pic_num;