wrapper/libavc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

mvc: fix integer overflows while computing display poc

Browse source 
Bug: 242274872
Bug: 244651074
Test: fuzzer poc in bug
Change-Id: I6c4ff7d48ea435913a79e30f3c61d93777d03975
This commit is contained in:
Ashwin Natesan 2022-08-12 22:51:56 +05:30
parent eb463e5aa2
commit 80bba33ec2
2 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
decoder/mvc/imvcd_api.c
View file

@ -1015,7 +1015,8 @@ static IV_API_CALL_STATUS_T imvcd_finish_au_decode(mvc_dec_ctxt_t *ps_mvcd_ctxt,
bool b_is_idr = imvcd_is_idr_au(ps_mvcd_ctxt);
bool b_is_ref_au = !!ps_mvcd_ctxt->au1_nal_ref_idc[ps_mvcd_ctxt->u2_num_views - 1];
WORD64 i8_display_poc = ps_view_ctxt->i4_prev_max_display_seq + ps_cur_au->i4_poc;
WORD64 i8_display_poc =
((WORD64) ps_view_ctxt->i4_prev_max_display_seq) + ((WORD64) ps_cur_au->i4_poc);
imvcd_dpb_delete_nonref_nondisplay_pics(ps_dpb_mgr);

2
decoder/mvc/imvcd_slice_functions.c
View file

@ -612,7 +612,7 @@ static WORD32 imvcd_decode_gaps_in_frame_num(mvc_dec_ctxt_t *ps_mvcd_ctxt)
}
}
i8_display_poc = ps_view_ctxt->i4_prev_max_display_seq + i4_poc;
i8_display_poc = ((WORD64) ps_view_ctxt->i4_prev_max_display_seq) + ((WORD64) i4_poc);
if(IS_OUT_OF_RANGE_S32(i8_display_poc))
{