wrapper/libavc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

mvc: added check for incorrect abs_diff_view_idx_minus1 am: 83047b4d6e am: 0fd7754389

Browse source 
Original change: 2202375

Change-Id: Iac7f00525c6c804d9e75cbd9e9be159cda6ca820
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Ashwin Natesan 2022-09-05 15:46:17 +00:00 • committed by Automerger Merge Worker
commit fab2bce1f1
1 changed files with 14 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

18
decoder/mvc/imvcd_dpb_manager.c
View file

@ -1243,9 +1243,21 @@ WORD32 imvcd_dpb_reorder_ref_pic_list(mvc_dpb_manager_t *ps_dpb_mgr,
{ {
WORD32 i4_target_view_id; WORD32 i4_target_view_id;
WORD32 i4_mod_view_order_id = pi4_abs_diff_view_idx_minus1[0] + 1; WORD32 i4_mod_view_order_id = pi4_abs_diff_view_idx_minus1[0];
UWORD8 u1_mod_buf_idx = u1_num_ref_bufs; UWORD8 u1_mod_buf_idx = u1_num_ref_bufs;
/* According to section H.7.4.3.1.1 from spec, */
/* this value is expected to be from the */
/* closed interval [0, u2_max_view_idx - 1] */
if((i4_mod_view_order_id < 0) || (i4_mod_view_order_id >= u2_max_view_idx))
{
return ERROR_DBP_MANAGER_T;
}
/* +1 not accounted during initialisation, */
/* mainly to preclude integer overflow */
i4_mod_view_order_id++;
if(4 == pu1_modification_of_pic_nums_idc[0]) if(4 == pu1_modification_of_pic_nums_idc[0])
{ {
i4_mod_view_order_id = i2_pred_view_order_id - i4_mod_view_order_id; i4_mod_view_order_id = i2_pred_view_order_id - i4_mod_view_order_id;
@ -1265,9 +1277,7 @@ WORD32 imvcd_dpb_reorder_ref_pic_list(mvc_dpb_manager_t *ps_dpb_mgr,
} }
} }
if((0 == u2_view_order_id) || if((0 == u2_view_order_id) || (NULL == ps_mvc_ivp_ref_data))
!((i4_mod_view_order_id >= 0) && (i4_mod_view_order_id <= u2_max_view_idx)) ||
(NULL == ps_mvc_ivp_ref_data))
{ {
return ERROR_DBP_MANAGER_T; return ERROR_DBP_MANAGER_T;
} }