wrapper/libavc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Move slice increments after completing header parsing

Browse source 
Slice increments are now done after completing header parse.
Earlier this was done before validating mmco related parameters
and calculating poc. In case there were errors that were detected
at this stage, slice increments were incorrect.

Bug: 199536974
Bug: 199733300
Bug: 205702093
Bug: oss-fuzz#38387
Bug: oss-fuzz#38482
Bug: oss-fuzz#40851
Test: ossfuzz generated poc in bug

Change-Id: I8569e9369e4ab6f6c69c81b937f111c299b7a134
(cherry picked from commit cd0385dc07)
This commit is contained in:
Harish Mahendrakar 2021-10-05 15:35:31 -07:00 • committed by Ray Essick
parent 6ddeb05426
commit dc110841d6
1 changed files with 16 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

33
decoder/ih264d_parse_slice.c
View file

@ -1476,23 +1476,6 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
i1_is_end_of_poc = 0; i1_is_end_of_poc = 0;
} }
/* Increment only if the current slice has atleast 1 more MB */
if (ps_dec->u4_first_slice_in_pic == 0 &&
(ps_dec->ps_parse_cur_slice->u4_first_mb_in_slice <
(UWORD32)(ps_dec->u2_total_mbs_coded >> ps_dec->ps_cur_slice->u1_mbaff_frame_flag)))
{
ps_dec->ps_parse_cur_slice++;
ps_dec->u2_cur_slice_num++;
// in the case of single core increment ps_decode_cur_slice
if(ps_dec->u1_separate_parse == 0)
{
ps_dec->ps_decode_cur_slice++;
}
}
ps_dec->u1_slice_header_done = 0;
if(u1_field_pic_flag) if(u1_field_pic_flag)
{ {
ps_dec->u2_prv_frame_num = u2_frame_num; ps_dec->u2_prv_frame_num = u2_frame_num;
@ -1546,6 +1529,22 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
} }
} }
/* Increment only if the current slice has atleast 1 more MB */
if (ps_dec->u4_first_slice_in_pic == 0 &&
(ps_dec->ps_parse_cur_slice->u4_first_mb_in_slice <
(UWORD32)(ps_dec->u2_total_mbs_coded >> ps_dec->ps_cur_slice->u1_mbaff_frame_flag)))
{
ps_dec->ps_parse_cur_slice++;
ps_dec->u2_cur_slice_num++;
// in the case of single core increment ps_decode_cur_slice
if(ps_dec->u1_separate_parse == 0)
{
ps_dec->ps_decode_cur_slice++;
}
}
ps_dec->u1_slice_header_done = 0;
/*--------------------------------------------------------------------*/ /*--------------------------------------------------------------------*/
/* Copy the values read from the bitstream to the slice header and then*/ /* Copy the values read from the bitstream to the slice header and then*/
/* If the slice is first slice in picture, then do Start of Picture */ /* If the slice is first slice in picture, then do Start of Picture */