Fix issue 3186 (fuzz 18458). Reset held picture reordering list before calling DestroyPicBuff.

It also fix SetUnRef crashing which should only loop for LIST_1 if ref pic is B_SLICE.

xiaotiansf committed 7 years ago

Commit 8b881441 parent fafdd888 files · +163 −147Browse files

Showing the changes to codec/decoder/core/src/decoder.cpp (1 of 8 files). Show all

Unified · Split

 static int32_t CreatePicBuff (PWelsDecoderContext pCtx, PPicBuff* ppPicBuf, const int32_t kiSize,
                               const int32_t kiPicWidth, const int32_t kiPicHeight) {
   PPicBuff pPicBuf = NULL;
   int32_t iPicIdx = 0;
   if (kiSize <= 0 || kiPicWidth <= 0 || kiPicHeight <= 0) {
   if (NULL == pPicBuf->ppPic) {
     pPicBuf->iCapacity = 0;
-    DestroyPicBuff (&pPicBuf, pMa);
+    DestroyPicBuff (pCtx, &pPicBuf, pMa);
     return ERR_INFO_OUT_OF_MEMORY;
   }
     if (NULL == pPic) {
       // init capacity first for free memory
       pPicBuf->iCapacity = iPicIdx;
-      DestroyPicBuff (&pPicBuf, pMa);
+      DestroyPicBuff (pCtx, &pPicBuf, pMa);
       return ERR_INFO_OUT_OF_MEMORY;
     }
     pPicBuf->ppPic[iPicIdx] = pPic;
   if (NULL == pPicNewBuf->ppPic) {
     pPicNewBuf->iCapacity = 0;
-    DestroyPicBuff (&pPicNewBuf, pMa);
+    DestroyPicBuff (pCtx, &pPicNewBuf, pMa);
     return ERR_INFO_OUT_OF_MEMORY;
   }
     if (NULL == pPic) {
       // Set maximum capacity as the new malloc memory at the tail
       pPicNewBuf->iCapacity = iPicIdx;
-      DestroyPicBuff (&pPicNewBuf, pMa);
+      DestroyPicBuff (pCtx, &pPicNewBuf, pMa);
       return ERR_INFO_OUT_OF_MEMORY;
     }
     pPicNewBuf->ppPic[iPicIdx] = pPic;
   if (NULL == pPicNewBuf->ppPic) {
     pPicNewBuf->iCapacity = 0;
-    DestroyPicBuff (&pPicNewBuf, pMa);
+    DestroyPicBuff (pCtx, &pPicNewBuf, pMa);
     return ERR_INFO_OUT_OF_MEMORY;
   }
   return ERR_NONE;
 }
-void DestroyPicBuff (PPicBuff* ppPicBuf, CMemoryAlign* pMa) {
+void DestroyPicBuff (PWelsDecoderContext pCtx, PPicBuff* ppPicBuf, CMemoryAlign* pMa) {
   PPicBuff pPicBuf = NULL;
+  ResetReorderingPictureBuffers (pCtx->pPictReoderingStatus, pCtx->pPictInfoList, false);
   if (NULL == ppPicBuf || NULL == *ppPicBuf)
     return;
   *ppPicBuf = NULL;
 }
+//reset picture reodering buffer list
+void ResetReorderingPictureBuffers (PPictReoderingStatus pPictReoderingStatus, PPictInfo pPictInfo,
+                                    const bool& fullReset) {
+  if (pPictReoderingStatus != NULL && pPictInfo != NULL) {
+    int32_t pictInfoListCount = fullReset ? 16 : (pPictReoderingStatus->iLargestBufferedPicIndex + 1);
+    pPictReoderingStatus->iPictInfoIndex = 0;
+    pPictReoderingStatus->iMinPOC = IMinInt32;
+    pPictReoderingStatus->iNumOfPicts = 0;
+    pPictReoderingStatus->iLastGOPRemainPicts = 0;
+    pPictReoderingStatus->iLastWrittenPOC = IMinInt32;
+    pPictReoderingStatus->iLargestBufferedPicIndex = 0;
+    for (int32_t i = 0; i < pictInfoListCount; ++i) {
+      pPictInfo[i].bLastGOP = false;
+      pPictInfo[i].iPOC = IMinInt32;
+    }
+  }
+}
 /*
  * fill data fields in default for decoder context
  */
     // for Recycled_Pic_Queue
     PPicBuff* ppPic = &pCtx->pPicBuff;
     if (NULL != ppPic && NULL != *ppPic) {
-      DestroyPicBuff (ppPic, pMa);
+      DestroyPicBuff (pCtx, ppPic, pMa);
     }
   PPicBuff* pPicBuff = &pCtx->pPicBuff;
   if (NULL != pPicBuff && NULL != *pPicBuff) {
-    DestroyPicBuff (pPicBuff, pMa);
+    DestroyPicBuff (pCtx, pPicBuff, pMa);
   }
   if (pCtx->pTempDec) {

Fix issue 3186 (fuzz 18458). Reset held picture reordering list before calling DestroyPicBuff.

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code