wrapper/libavc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

mvc: added check for incorrect abs_diff_view_idx_minus1

Browse source 
abs_diff_view_idx_minus1 is present in NALU with NALUID=20
within ref_pic_list_mvc_modification

Bug: 242723830
Test: fuzzer poc in bug
Change-Id: I6ff31b3294cd01484712eebdb6bff1e336f06e38
This commit is contained in:
Ashwin Natesan 2022-09-05 14:12:12 +05:30
parent 9c75f6b991
commit 83047b4d6e
No known key found for this signature in database
GPG key ID: F9C8103B9094CF1A
1 changed files with 14 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

18
decoder/mvc/imvcd_dpb_manager.c
View file

@ -1243,9 +1243,21 @@ WORD32 imvcd_dpb_reorder_ref_pic_list(mvc_dpb_manager_t *ps_dpb_mgr,
{ {
WORD32 i4_target_view_id; WORD32 i4_target_view_id;
WORD32 i4_mod_view_order_id = pi4_abs_diff_view_idx_minus1[0] + 1; WORD32 i4_mod_view_order_id = pi4_abs_diff_view_idx_minus1[0];
UWORD8 u1_mod_buf_idx = u1_num_ref_bufs; UWORD8 u1_mod_buf_idx = u1_num_ref_bufs;
/* According to section H.7.4.3.1.1 from spec, */
/* this value is expected to be from the */
/* closed interval [0, u2_max_view_idx - 1] */
if((i4_mod_view_order_id < 0) || (i4_mod_view_order_id >= u2_max_view_idx))
{
return ERROR_DBP_MANAGER_T;
}
/* +1 not accounted during initialisation, */
/* mainly to preclude integer overflow */
i4_mod_view_order_id++;
if(4 == pu1_modification_of_pic_nums_idc[0]) if(4 == pu1_modification_of_pic_nums_idc[0])
{ {
i4_mod_view_order_id = i2_pred_view_order_id - i4_mod_view_order_id; i4_mod_view_order_id = i2_pred_view_order_id - i4_mod_view_order_id;
@ -1265,9 +1277,7 @@ WORD32 imvcd_dpb_reorder_ref_pic_list(mvc_dpb_manager_t *ps_dpb_mgr,
} }
} }
if((0 == u2_view_order_id) || if((0 == u2_view_order_id) || (NULL == ps_mvc_ivp_ref_data))
!((i4_mod_view_order_id >= 0) && (i4_mod_view_order_id <= u2_max_view_idx)) ||
(NULL == ps_mvc_ivp_ref_data))
{ {
return ERROR_DBP_MANAGER_T; return ERROR_DBP_MANAGER_T;
} }