From 17f097626f079bc9dfe5c397288b3bf8948cb387 Mon Sep 17 00:00:00 2001 From: Ashwin Natesan Date: Tue, 30 Aug 2022 10:14:10 +0530 Subject: [PATCH] mvc: corrected handling of incorrect bitstreams in mmco parsing Test: fuzzer poc in bug Bug: 243507465 Bug: 243980319 Change-Id: Ie0fa865791948693d7cd1665965022302ec56203 --- decoder/mvc/imvcd_dpb_manager.c | 93 +++++++++++++++++++++------------ decoder/mvc/imvcd_dpb_manager.h | 3 ++ 2 files changed, 62 insertions(+), 34 deletions(-) diff --git a/decoder/mvc/imvcd_dpb_manager.c b/decoder/mvc/imvcd_dpb_manager.c index 7a88d67..076ce2b 100644 --- a/decoder/mvc/imvcd_dpb_manager.c +++ b/decoder/mvc/imvcd_dpb_manager.c @@ -1862,9 +1862,10 @@ WORD32 imvcd_dpb_do_mmco(dpb_commands_t *ps_dpb_cmds, mvc_dpb_manager_t *ps_dpb_ UWORD32 u4_mmco; UWORD32 u4_diff_pic_num; - WORD32 i4_pic_num; UWORD32 u4_lt_idx; + UWORD32 au4_num_mmco_cmds[NUM_MMCO_CMD_IDS] = {0}; + for(j = 0; j < ps_dpb_cmds->u1_num_of_commands; j++) { ps_mmc_params = &ps_dpb_cmds->as_mmc_params[j]; @@ -1884,12 +1885,10 @@ WORD32 imvcd_dpb_do_mmco(dpb_commands_t *ps_dpb_cmds, mvc_dpb_manager_t *ps_dpb_ return ERROR_DBP_MANAGER_T; } - i4_pic_num = i8_pic_num; - if(ps_dpb_mgr->u1_num_st_ref_bufs > 0) { - i4_error_code = imvcd_dpb_delete_st_node_or_make_lt(ps_dpb_mgr, i4_pic_num, - MAX_REF_BUFS + 1); + i4_error_code = imvcd_dpb_delete_st_node_or_make_lt( + ps_dpb_mgr, (WORD32) i8_pic_num, MAX_REF_BUFS + 1); if(i4_error_code != OK) { @@ -1900,8 +1899,8 @@ WORD32 imvcd_dpb_do_mmco(dpb_commands_t *ps_dpb_cmds, mvc_dpb_manager_t *ps_dpb_ { UWORD8 u1_dummy; - i4_error_code = - imvcd_dpb_delete_gap_frm_mmco(ps_dpb_mgr, i4_pic_num, &u1_dummy); + i4_error_code = imvcd_dpb_delete_gap_frm_mmco( + ps_dpb_mgr, (WORD32) i8_pic_num, &u1_dummy); if(i4_error_code != OK) { @@ -1937,8 +1936,6 @@ WORD32 imvcd_dpb_do_mmco(dpb_commands_t *ps_dpb_cmds, mvc_dpb_manager_t *ps_dpb_ return ERROR_DBP_MANAGER_T; } - i4_pic_num = i8_pic_num; - u4_lt_idx = ps_mmc_params->u4_lt_idx; if((ps_dpb_mgr->u1_max_lt_frame_idx == NO_LONG_TERM_INDICIES) || @@ -1949,8 +1946,8 @@ WORD32 imvcd_dpb_do_mmco(dpb_commands_t *ps_dpb_cmds, mvc_dpb_manager_t *ps_dpb_ if(ps_dpb_mgr->u1_num_st_ref_bufs > 0) { - i4_error_code = - imvcd_dpb_delete_st_node_or_make_lt(ps_dpb_mgr, i4_pic_num, u4_lt_idx); + i4_error_code = imvcd_dpb_delete_st_node_or_make_lt( + ps_dpb_mgr, (WORD32) i8_pic_num, u4_lt_idx); if(i4_error_code != OK) { @@ -1962,6 +1959,11 @@ WORD32 imvcd_dpb_do_mmco(dpb_commands_t *ps_dpb_cmds, mvc_dpb_manager_t *ps_dpb_ } case SET_MAX_LT_INDEX: { + if(au4_num_mmco_cmds[SET_MAX_LT_INDEX] > 0) + { + return ERROR_DBP_MANAGER_T; + } + u4_lt_idx = ps_mmc_params->u4_max_lt_idx_plus1; // Get Max_long_term_index_plus1 @@ -2034,6 +2036,11 @@ WORD32 imvcd_dpb_do_mmco(dpb_commands_t *ps_dpb_cmds, mvc_dpb_manager_t *ps_dpb_ } case SET_LT_INDEX: { + if(au4_num_mmco_cmds[SET_LT_INDEX] > 0) + { + return ERROR_DBP_MANAGER_T; + } + u4_lt_idx = ps_mmc_params->u4_lt_idx; // Get long term index if((ps_dpb_mgr->u1_max_lt_frame_idx == NO_LONG_TERM_INDICIES) || @@ -2068,34 +2075,52 @@ WORD32 imvcd_dpb_do_mmco(dpb_commands_t *ps_dpb_cmds, mvc_dpb_manager_t *ps_dpb_ break; } + case RESET_REF_PICTURES: + { + if((au4_num_mmco_cmds[RESET_REF_PICTURES] > 0) || + (au4_num_mmco_cmds[MARK_ST_PICNUM_AS_NONREF] > 0) || + (au4_num_mmco_cmds[MARK_LT_INDEX_AS_NONREF] > 0) || + (au4_num_mmco_cmds[MARK_ST_PICNUM_AS_LT_INDEX] > 0)) + { + return ERROR_DBP_MANAGER_T; + } + + if((j > 0) && (ps_dpb_cmds->as_mmc_params[j - 1].u4_mmco == SET_LT_INDEX)) + { + return ERROR_DBP_MANAGER_T; + } + + __attribute__((fallthrough)); + } + case RESET_ALL_PICTURES: + { + WORD32 i4_pic_num = ps_cur_au->i4_frame_num; + + imvcd_reset_dpb(ps_dpb_mgr); + + ps_cur_au->i4_frame_num = 0; + + if(!u1_marked_lt && u1_insert_st_pic) + { + i4_error_code = imvcd_dpb_insert_st_node(ps_dpb_mgr, ps_cur_au); + + if(i4_error_code != OK) + { + return i4_error_code; + } + } + + ps_cur_au->i4_frame_num = i4_pic_num; + + return OK; + } default: { - break; + return ERROR_DBP_MANAGER_T; } } - if((u4_mmco == RESET_REF_PICTURES) || (u4_mmco == RESET_ALL_PICTURES)) - { - i4_pic_num = ps_cur_au->i4_frame_num; - - imvcd_reset_dpb(ps_dpb_mgr); - - ps_cur_au->i4_frame_num = 0; - - if(!u1_marked_lt && u1_insert_st_pic) - { - i4_error_code = imvcd_dpb_insert_st_node(ps_dpb_mgr, ps_cur_au); - - if(i4_error_code != OK) - { - return i4_error_code; - } - } - - ps_cur_au->i4_frame_num = i4_pic_num; - - return OK; - } + au4_num_mmco_cmds[u4_mmco]++; } } diff --git a/decoder/mvc/imvcd_dpb_manager.h b/decoder/mvc/imvcd_dpb_manager.h index e0cd46b..0c3d914 100644 --- a/decoder/mvc/imvcd_dpb_manager.h +++ b/decoder/mvc/imvcd_dpb_manager.h @@ -34,10 +34,13 @@ #include "ih264_error.h" #include "ih264_buf_mgr.h" #include "ih264_disp_mgr.h" +#include "ih264d_dpb_manager.h" #include "imvcd_defs.h" #include "imvcd_structs.h" #include "imvcd_utils.h" +#define NUM_MMCO_CMD_IDS ((RESET_ALL_PICTURES) + 1) + typedef struct mvc_dpb_info_t { mvc_au_buffer_t *ps_au_buf;