History

Fix issue 3186 (fuzz 18458). Reset held picture reordering list before calling DestroyPicBuff.

It also fix SetUnRef crashing which should only loop for LIST_1 if ref pic is B_SLICE.

xiaotiansf committed 7 years ago

Commit 8b881441 parent fafdd888 files · +163 −147Browse files

Showing the changes to codec/decoder/core/src/decoder.cpp (1 of 8 files). Show all

Unified · Split

codec/decoder/core/src/decoder.cpp+29−8
@@ -62,6 +62,7 @@ extern void FreePicture (PPicture pPic, CMemoryAlign* pMa); · 61 unmodified lines
6262
6363 static int32_t CreatePicBuff (PWelsDecoderContext pCtx, PPicBuff* ppPicBuf, const int32_t kiSize,
6464 const int32_t kiPicWidth, const int32_t kiPicHeight) {
65+
6566 PPicBuff pPicBuf = NULL;
6667 int32_t iPicIdx = 0;
6768 if (kiSize <= 0 || kiPicWidth <= 0 || kiPicHeight <= 0) {
@@ -80,7 +81,7 @@ static int32_t CreatePicBuff (PWelsDecoderContext pCtx, PPicBuff* ppPicBuf, cons · 12 unmodified lines
8081
8182 if (NULL == pPicBuf->ppPic) {
8283 pPicBuf->iCapacity = 0;
83− DestroyPicBuff (&pPicBuf, pMa);
84+ DestroyPicBuff (pCtx, &pPicBuf, pMa);
8485 return ERR_INFO_OUT_OF_MEMORY;
8586 }
8687
@@ -89,7 +90,7 @@ static int32_t CreatePicBuff (PWelsDecoderContext pCtx, PPicBuff* ppPicBuf, cons · 2 unmodified lines
8990 if (NULL == pPic) {
9091 // init capacity first for free memory
9192 pPicBuf->iCapacity = iPicIdx;
92− DestroyPicBuff (&pPicBuf, pMa);
93+ DestroyPicBuff (pCtx, &pPicBuf, pMa);
9394 return ERR_INFO_OUT_OF_MEMORY;
9495 }
9596 pPicBuf->ppPic[iPicIdx] = pPic;
@@ -123,7 +124,7 @@ static int32_t IncreasePicBuff (PWelsDecoderContext pCtx, PPicBuff* ppPicBuf, co · 27 unmodified lines
123124
124125 if (NULL == pPicNewBuf->ppPic) {
125126 pPicNewBuf->iCapacity = 0;
126− DestroyPicBuff (&pPicNewBuf, pMa);
127+ DestroyPicBuff (pCtx, &pPicNewBuf, pMa);
127128 return ERR_INFO_OUT_OF_MEMORY;
128129 }
129130
@@ -133,7 +134,7 @@ static int32_t IncreasePicBuff (PWelsDecoderContext pCtx, PPicBuff* ppPicBuf, co · 3 unmodified lines
133134 if (NULL == pPic) {
134135 // Set maximum capacity as the new malloc memory at the tail
135136 pPicNewBuf->iCapacity = iPicIdx;
136− DestroyPicBuff (&pPicNewBuf, pMa);
137+ DestroyPicBuff (pCtx, &pPicNewBuf, pMa);
137138 return ERR_INFO_OUT_OF_MEMORY;
138139 }
139140 pPicNewBuf->ppPic[iPicIdx] = pPic;
@@ -187,7 +188,7 @@ static int32_t DecreasePicBuff (PWelsDecoderContext pCtx, PPicBuff* ppPicBuf, co · 47 unmodified lines
187188
188189 if (NULL == pPicNewBuf->ppPic) {
189190 pPicNewBuf->iCapacity = 0;
190− DestroyPicBuff (&pPicNewBuf, pMa);
191+ DestroyPicBuff (pCtx, &pPicNewBuf, pMa);
191192 return ERR_INFO_OUT_OF_MEMORY;
192193 }
193194
@@ -254,9 +255,11 @@ static int32_t DecreasePicBuff (PWelsDecoderContext pCtx, PPicBuff* ppPicBuf, co · 60 unmodified lines
254255 return ERR_NONE;
255256 }
256257
257−void DestroyPicBuff (PPicBuff* ppPicBuf, CMemoryAlign* pMa) {
258+void DestroyPicBuff (PWelsDecoderContext pCtx, PPicBuff* ppPicBuf, CMemoryAlign* pMa) {
258259 PPicBuff pPicBuf = NULL;
259260
261+ ResetReorderingPictureBuffers (pCtx->pPictReoderingStatus, pCtx->pPictInfoList, false);
262+
260263 if (NULL == ppPicBuf || NULL == *ppPicBuf)
261264 return;
262265
@@ -285,6 +288,24 @@ void DestroyPicBuff (PPicBuff* ppPicBuf, CMemoryAlign* pMa) { · 22 unmodified lines
285288 *ppPicBuf = NULL;
286289 }
287290
291+//reset picture reodering buffer list
292+void ResetReorderingPictureBuffers (PPictReoderingStatus pPictReoderingStatus, PPictInfo pPictInfo,
293+ const bool& fullReset) {
294+ if (pPictReoderingStatus != NULL && pPictInfo != NULL) {
295+ int32_t pictInfoListCount = fullReset ? 16 : (pPictReoderingStatus->iLargestBufferedPicIndex + 1);
296+ pPictReoderingStatus->iPictInfoIndex = 0;
297+ pPictReoderingStatus->iMinPOC = IMinInt32;
298+ pPictReoderingStatus->iNumOfPicts = 0;
299+ pPictReoderingStatus->iLastGOPRemainPicts = 0;
300+ pPictReoderingStatus->iLastWrittenPOC = IMinInt32;
301+ pPictReoderingStatus->iLargestBufferedPicIndex = 0;
302+ for (int32_t i = 0; i < pictInfoListCount; ++i) {
303+ pPictInfo[i].bLastGOP = false;
304+ pPictInfo[i].iPOC = IMinInt32;
305+ }
306+ }
307+}
308+
288309 /*
289310 * fill data fields in default for decoder context
290311 */
@@ -485,7 +506,7 @@ int32_t WelsRequestMem (PWelsDecoderContext pCtx, const int32_t kiMbWidth, const · 194 unmodified lines
485506 // for Recycled_Pic_Queue
486507 PPicBuff* ppPic = &pCtx->pPicBuff;
487508 if (NULL != ppPic && NULL != *ppPic) {
488− DestroyPicBuff (ppPic, pMa);
509+ DestroyPicBuff (pCtx, ppPic, pMa);
489510 }
490511
491512
@@ -531,7 +552,7 @@ void WelsFreeDynamicMemory (PWelsDecoderContext pCtx) { · 39 unmodified lines
531552
532553 PPicBuff* pPicBuff = &pCtx->pPicBuff;
533554 if (NULL != pPicBuff && NULL != *pPicBuff) {
534− DestroyPicBuff (pPicBuff, pMa);
555+ DestroyPicBuff (pCtx, pPicBuff, pMa);
535556 }
536557
537558 if (pCtx->pTempDec) {

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t