History

Fix AddressSanitizer: heap-use-after-free at decoder.cpp:178. New GOP start can be missed if GOP does not start with picture POC = 0 or the picture POC failed to decoder. The fix is to detect GOP change more accurately so that previous pictures can be flushed out immediately.

xiaotiansf committed 7 years ago

Commit 80a06fc1 parent cfb22041 file · +19 −1Browse files

Showing the changes to codec/decoder/plus/src/welsDecoderExt.cpp (1 of 1 file). Show all

Unified · Split

codec/decoder/plus/src/welsDecoderExt.cpp+19−1
@@ -580,7 +580,6 @@ DECODING_STATE CWelsDecoder::DecodeFrame2 (const unsigned char* kpSrc, · 579 unmodified lines
580 NAL_UNIT_UNSPEC_0; //for NBR, IDR frames are expected to decode as followed if error decoding an IDR currently580 NAL_UNIT_UNSPEC_0; //for NBR, IDR frames are expected to decode as followed if error decoding an IDR currently
581 581
582 eNalType = m_pDecContext->sCurNalHead.eNalUnitType;582 eNalType = m_pDecContext->sCurNalHead.eNalUnitType;
583
584 if (m_pDecContext->iErrorCode & dsOutOfMemory) {583 if (m_pDecContext->iErrorCode & dsOutOfMemory) {
585 if (ResetDecoder()) {584 if (ResetDecoder()) {
586 return dsOutOfMemory;585 return dsOutOfMemory;
@@ -765,6 +764,25 @@ DECODING_STATE CWelsDecoder::ReorderPicturesInDisplay (unsigned char** ppDst, SB · 178 unmodified lines
765 }764 }
766 }765 }
767 }766 }
767 } else {
768 if (m_iNumOfPicts > 0) {
769 //This can happen when decoder moves to next GOP without being able to decoder first picture PicOrderCntLsb = 0
770 bool hasGOPChanged = false;
771 for (int32_t i = 0; i <= m_iLargestBufferedPicIndex; ++i) {
772 if (m_sPictInfoList[i].iPOC == m_pDecContext->pSliceHeader->iPicOrderCntLsb) {
773 hasGOPChanged = true;
774 break;
775 }
776 }
777 if (hasGOPChanged) {
778 m_iLastGOPRemainPicts = m_iNumOfPicts;
779 for (int32_t i = 0; i <= m_iLargestBufferedPicIndex; ++i) {
780 if (m_sPictInfoList[i].iPOC > sIMinInt32) {
781 m_sPictInfoList[i].bLastGOP = true;
782 }
783 }
784 }
785 }
768 }786 }
769 for (int32_t i = 0; i < 16; ++i) {787 for (int32_t i = 0; i < 16; ++i) {
770 if (m_sPictInfoList[i].iPOC == sIMinInt32) {788 if (m_sPictInfoList[i].iPOC == sIMinInt32) {

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t