fix ossfuzz issue: decoder hits infinite loop when iMaxLongTermFrameIdx is invalid (exceeds the maximum)

xiaotianshi2 committed 6 years ago

Commit 77406e61 parent d9c90051 file · +6 −1Browse files

Showing the changes to codec/decoder/core/src/decoder_core.cpp (1 of 1 file). Show all

Unified · Split

codec/decoder/core/src/decoder_core.cpp+6−1

@@ -543,7 +543,12 @@ int32_t ParseDecRefPicMarking (PWelsDecoderContext pCtx, PBitStringAux pBs, PSli · 542 unmodified lines
543	543	WELS_VERIFY_RETURN_IF (-1, bMmco4Exist);
544	544	bMmco4Exist = true;
545	545	WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //max_long_term_frame_idx_plus1
546		− kpRefMarking->sMmcoRef[iIdx].iMaxLongTermFrameIdx = -1 + uiCode;
	546	+ int32_t iMaxLongTermFrameIdx = -1 + uiCode;
	547	+ if (iMaxLongTermFrameIdx > int32_t (pSps->uiLog2MaxFrameNum)) {
	548	+ //ISO/IEC 14496-10:2009(E) 7.4.3.3 Decoded reference picture marking semantics page 96
	549	+ return GENERATE_ERROR_NO (ERR_LEVEL_SLICE_HEADER, ERR_INFO_INVALID_REF_MARKING);
	550	+ }
	551	+ kpRefMarking->sMmcoRef[iIdx].iMaxLongTermFrameIdx = iMaxLongTermFrameIdx;
547	552	} else if (kuiMmco == MMCO_RESET) {
548	553	WELS_VERIFY_RETURN_IF (-1, (!bAllowMmco5 \|\| bMmco5Exist));
549	554	bMmco5Exist = true;