From 83047b4d6e17621f5a2463fb37d178eb3e7d1e92 Mon Sep 17 00:00:00 2001 From: Ashwin Natesan Date: Mon, 5 Sep 2022 14:12:12 +0530 Subject: [PATCH] mvc: added check for incorrect abs_diff_view_idx_minus1 abs_diff_view_idx_minus1 is present in NALU with NALUID=20 within ref_pic_list_mvc_modification Bug: 242723830 Test: fuzzer poc in bug Change-Id: I6ff31b3294cd01484712eebdb6bff1e336f06e38 --- decoder/mvc/imvcd_dpb_manager.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/decoder/mvc/imvcd_dpb_manager.c b/decoder/mvc/imvcd_dpb_manager.c index 8fa3f58..76cb80a 100644 --- a/decoder/mvc/imvcd_dpb_manager.c +++ b/decoder/mvc/imvcd_dpb_manager.c @@ -1243,9 +1243,21 @@ WORD32 imvcd_dpb_reorder_ref_pic_list(mvc_dpb_manager_t *ps_dpb_mgr, { WORD32 i4_target_view_id; - WORD32 i4_mod_view_order_id = pi4_abs_diff_view_idx_minus1[0] + 1; + WORD32 i4_mod_view_order_id = pi4_abs_diff_view_idx_minus1[0]; UWORD8 u1_mod_buf_idx = u1_num_ref_bufs; + /* According to section H.7.4.3.1.1 from spec, */ + /* this value is expected to be from the */ + /* closed interval [0, u2_max_view_idx - 1] */ + if((i4_mod_view_order_id < 0) || (i4_mod_view_order_id >= u2_max_view_idx)) + { + return ERROR_DBP_MANAGER_T; + } + + /* +1 not accounted during initialisation, */ + /* mainly to preclude integer overflow */ + i4_mod_view_order_id++; + if(4 == pu1_modification_of_pic_nums_idc[0]) { i4_mod_view_order_id = i2_pred_view_order_id - i4_mod_view_order_id; @@ -1265,9 +1277,7 @@ WORD32 imvcd_dpb_reorder_ref_pic_list(mvc_dpb_manager_t *ps_dpb_mgr, } } - if((0 == u2_view_order_id) || - !((i4_mod_view_order_id >= 0) && (i4_mod_view_order_id <= u2_max_view_idx)) || - (NULL == ps_mvc_ivp_ref_data)) + if((0 == u2_view_order_id) || (NULL == ps_mvc_ivp_ref_data)) { return ERROR_DBP_MANAGER_T; }