From d2f8ae1661e4bc26822b57c77312ccc835a6701b Mon Sep 17 00:00:00 2001 From: Ashwin Natesan Date: Mon, 5 Sep 2022 13:55:45 +0530 Subject: [PATCH] mvc: added check for incorrect abs_diff_pic_num_minus1 Bug: 242723830 Test: fuzzer poc in bug Change-Id: Ic5190ac52aa2fe145f9b7a7cbaaf5c460a7fbd01 --- decoder/mvc/imvcd_dpb_manager.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/decoder/mvc/imvcd_dpb_manager.c b/decoder/mvc/imvcd_dpb_manager.c index 8fa3f58..66ac195 100644 --- a/decoder/mvc/imvcd_dpb_manager.c +++ b/decoder/mvc/imvcd_dpb_manager.c @@ -1154,14 +1154,22 @@ WORD32 imvcd_dpb_reorder_ref_pic_list(mvc_dpb_manager_t *ps_dpb_mgr, if((0 == pu1_modification_of_pic_nums_idc[0]) || (1 == pu1_modification_of_pic_nums_idc[0])) { - WORD32 i4_mod_pic_num = 1 + pi4_abs_diff_pic_num_minus1[0]; + WORD32 i4_mod_pic_num = pi4_abs_diff_pic_num_minus1[0]; + UWORD8 u1_mod_buf_idx = u1_num_ref_bufs; - if(pi4_abs_diff_pic_num_minus1[0] > i4_max_pic_num) + /* According to section 7.4.3.1 from spec, */ + /* this value is expected to be from the */ + /* closed interval [0, i4_max_pic_num - 1] */ + if((i4_mod_pic_num < 0) || (i4_mod_pic_num >= i4_max_pic_num)) { return ERROR_DBP_MANAGER_T; } + /* +1 not accounted during initialisation, */ + /* mainly to preclude integer overflow */ + i4_mod_pic_num++; + if(0 == pu1_modification_of_pic_nums_idc[0]) { i4_mod_pic_num = i4_pred_pic_num - i4_mod_pic_num;