From 0f0cca684cd0808e86702057960bf2ef4f4e2111 Mon Sep 17 00:00:00 2001 From: Ashwin Natesan Date: Mon, 15 Aug 2022 14:56:15 +0530 Subject: [PATCH] mvc: corrected handling of incorrect bitstreams in refIdxActive parsing Test: fuzzer poc in bug Bug: 242723830 Change-Id: Ib43c6d24fd45cbab7fe2a7b4b698f50e95b2092a --- decoder/mvc/imvcd_slice_functions.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/decoder/mvc/imvcd_slice_functions.c b/decoder/mvc/imvcd_slice_functions.c index 34892d5..b3a9a00 100644 --- a/decoder/mvc/imvcd_slice_functions.c +++ b/decoder/mvc/imvcd_slice_functions.c @@ -221,15 +221,16 @@ static WORD32 imvcd_set_ref_idx_override_flag(dec_struct_t *ps_view_ctxt) static WORD32 imvcd_set_num_ref_idx_active(dec_struct_t *ps_view_ctxt, UWORD8 *pu1_num_ref_idx) { dec_bit_stream_t *ps_bitstrm = ps_view_ctxt->ps_bitstrm; + UWORD32 u4_num_ref_idx_m1 = ih264d_uev(&ps_bitstrm->u4_ofst, ps_bitstrm->pu4_buffer); - pu1_num_ref_idx[0] = 1 + ih264d_uev(&ps_bitstrm->u4_ofst, ps_bitstrm->pu4_buffer); - - if(pu1_num_ref_idx[0] > H264_MAX_REF_PICS) + if(u4_num_ref_idx_m1 >= H264_MAX_REF_PICS) { return ERROR_NUM_REF; } - COPYTHECONTEXT("SH: num_ref_idx_lx_active_minus1", pu1_num_ref_idx[0] - 1); + pu1_num_ref_idx[0] = 1 + u4_num_ref_idx_m1; + + COPYTHECONTEXT("SH: num_ref_idx_lx_active_minus1", u4_num_ref_idx_m1); return OK; }