wrapper/libavc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "mvc: added check for incorrect abs_diff_pic_num_minus1" am: c0b08788bb

Browse source 
Original change: 2206935

Change-Id: Iceba0eaf03b15a3f6d3a1cb4035a81d8325b7380
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Treehugger Robot 2022-09-07 18:03:01 +00:00 • committed by Automerger Merge Worker
commit 2f26d3d3f8
1 changed files with 10 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
decoder/mvc/imvcd_dpb_manager.c
View file

@ -1154,14 +1154,22 @@ WORD32 imvcd_dpb_reorder_ref_pic_list(mvc_dpb_manager_t *ps_dpb_mgr,
if((0 == pu1_modification_of_pic_nums_idc[0]) ||
(1 == pu1_modification_of_pic_nums_idc[0]))
{
WORD32 i4_mod_pic_num = 1 + pi4_abs_diff_pic_num_minus1[0];
WORD32 i4_mod_pic_num = pi4_abs_diff_pic_num_minus1[0];
UWORD8 u1_mod_buf_idx = u1_num_ref_bufs;
if(pi4_abs_diff_pic_num_minus1[0] > i4_max_pic_num)
/* According to section 7.4.3.1 from spec, */
/* this value is expected to be from the */
/* closed interval [0, i4_max_pic_num - 1] */
if((i4_mod_pic_num < 0) || (i4_mod_pic_num >= i4_max_pic_num))
{
return ERROR_DBP_MANAGER_T;
}
/* +1 not accounted during initialisation, */
/* mainly to preclude integer overflow */
i4_mod_pic_num++;
if(0 == pu1_modification_of_pic_nums_idc[0])
{
i4_mod_pic_num = i4_pred_pic_num - i4_mod_pic_num;