From f548c7afab7e48b79ab8432522d5f5dd1b71521b Mon Sep 17 00:00:00 2001 From: Ashwin Natesan Date: Tue, 16 Aug 2022 13:14:57 +0530 Subject: [PATCH] mvc: Fix for with excessive number of 'modification_of_pic_nums_idc' Bug: 242600232 Test: fuzzer poc in bug Change-Id: Ibb566320a452b38235b57bd4b7dd1215a37ca515 --- decoder/mvc/imvcd_slice_functions.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/decoder/mvc/imvcd_slice_functions.c b/decoder/mvc/imvcd_slice_functions.c index 34892d5..715e94e 100644 --- a/decoder/mvc/imvcd_slice_functions.c +++ b/decoder/mvc/imvcd_slice_functions.c @@ -425,6 +425,7 @@ static WORD32 imvcd_set_ref_pic_list_mod_data(mvc_dec_ctxt_t *ps_mvcd_ctxt) WORD32 *pi4_long_term_pic_num = ps_ref_pic_list_mod_data->ai4_long_term_pic_num[i]; WORD32 *pi4_abs_diff_view_idx_minus1 = ps_ref_pic_list_mod_data->ai4_abs_diff_view_idx_minus1[i]; + UWORD32 u4_pic_num_mod_count = 0; do { @@ -481,6 +482,12 @@ static WORD32 imvcd_set_ref_pic_list_mod_data(mvc_dec_ctxt_t *ps_mvcd_ctxt) pi4_abs_diff_pic_num_minus1++; pi4_long_term_pic_num++; pi4_abs_diff_view_idx_minus1++; + u4_pic_num_mod_count++; + + if(u4_pic_num_mod_count > ps_ref_pic_list_mod_data->au1_num_active_refs[i]) + { + return ERROR_INV_SLICE_HDR_T; + } } while(true); } }