History

Fix AddressSanitizer: heap-use-after-free at decoder.cpp:178. New GOP start can be missed if GOP does not start with picture POC = 0 or the picture POC failed to decoder. The fix is to detect GOP change more accurately so that previous pictures can be flushed out immediately.

xiaotiansf committed 7 years ago

Commit 80a06fc1 parent cfb22041 file · +19 −1Browse files

Showing the changes to codec/decoder/plus/src/welsDecoderExt.cpp (1 of 1 file). Show all

Unified · Split

codec/decoder/plus/src/welsDecoderExt.cpp+19−1
@@ -580,7 +580,6 @@ DECODING_STATE CWelsDecoder::DecodeFrame2 (const unsigned char* kpSrc, · 579 unmodified lines
580580 NAL_UNIT_UNSPEC_0; //for NBR, IDR frames are expected to decode as followed if error decoding an IDR currently
581581
582582 eNalType = m_pDecContext->sCurNalHead.eNalUnitType;
583−
584583 if (m_pDecContext->iErrorCode & dsOutOfMemory) {
585584 if (ResetDecoder()) {
586585 return dsOutOfMemory;
@@ -765,6 +764,25 @@ DECODING_STATE CWelsDecoder::ReorderPicturesInDisplay (unsigned char** ppDst, SB · 178 unmodified lines
765764 }
766765 }
767766 }
767+ } else {
768+ if (m_iNumOfPicts > 0) {
769+ //This can happen when decoder moves to next GOP without being able to decoder first picture PicOrderCntLsb = 0
770+ bool hasGOPChanged = false;
771+ for (int32_t i = 0; i <= m_iLargestBufferedPicIndex; ++i) {
772+ if (m_sPictInfoList[i].iPOC == m_pDecContext->pSliceHeader->iPicOrderCntLsb) {
773+ hasGOPChanged = true;
774+ break;
775+ }
776+ }
777+ if (hasGOPChanged) {
778+ m_iLastGOPRemainPicts = m_iNumOfPicts;
779+ for (int32_t i = 0; i <= m_iLargestBufferedPicIndex; ++i) {
780+ if (m_sPictInfoList[i].iPOC > sIMinInt32) {
781+ m_sPictInfoList[i].bLastGOP = true;
782+ }
783+ }
784+ }
785+ }
768786 }
769787 for (int32_t i = 0; i < 16; ++i) {
770788 if (m_sPictInfoList[i].iPOC == sIMinInt32) {

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t