History

Fix oss-fuzz reported bug 14423 which is caused by the fix of 14267 in DecreasePicBuff.

xiaotiansf committed 7 years ago

Commit a78d18a1 parent ccb105a1 file · +13 −14Browse files

Showing the changes to codec/decoder/core/src/decoder.cpp (1 of 1 file). Show all

Unified · Split

codec/decoder/core/src/decoder.cpp+13−14
@@ -212,21 +212,20 @@ static int32_t DecreasePicBuff (PWelsDecoderContext pCtx, PPicBuff* ppPicBuf, co · 211 unmodified lines
212212 //update references due to allocation changes
213213 for (int32_t i = 0; i < kiNewSize; i++) {
214214 for (int32_t listIdx = LIST_0; listIdx < LIST_A; ++listIdx) {
215− for (int32_t j = 0; j < MAX_DPB_COUNT; j++) {
216− if (pPicNewBuf->ppPic[i]->pRefPic[listIdx][j] != NULL) {
217− unsigned long long uiTimeStamp = pPicNewBuf->ppPic[i]->pRefPic[listIdx][j]->uiTimeStamp;
218− bool foundThePic = false;
219− for (int32_t k = 0; k < kiNewSize; k++) {
220− if (pPicNewBuf->ppPic[k]->uiTimeStamp == uiTimeStamp) {
221− pPicNewBuf->ppPic[i]->pRefPic[listIdx][j] = pPicNewBuf->ppPic[k];
222− foundThePic = true;
223− break;
224− }
225− }
226− if (!foundThePic) {
227− pPicNewBuf->ppPic[i]->pRefPic[listIdx][j] = NULL;
215+ int32_t j = -1;
216+ while (++j < MAX_DPB_COUNT && pPicNewBuf->ppPic[i]->pRefPic[listIdx][j] != NULL) {
217+ unsigned long long uiTimeStamp = pPicNewBuf->ppPic[i]->pRefPic[listIdx][j]->uiTimeStamp;
218+ bool foundThePic = false;
219+ for (int32_t k = 0; k < kiNewSize; k++) {
220+ if (pPicNewBuf->ppPic[k]->uiTimeStamp == uiTimeStamp) {
221+ pPicNewBuf->ppPic[i]->pRefPic[listIdx][j] = pPicNewBuf->ppPic[k];
222+ foundThePic = true;
223+ break;
228224 }
229225 }
226+ if (!foundThePic) {
227+ pPicNewBuf->ppPic[i]->pRefPic[listIdx][j] = NULL;
228+ }
230229 }
231230 }
232231 }
@@ -242,7 +241,7 @@ static int32_t DecreasePicBuff (PWelsDecoderContext pCtx, PPicBuff* ppPicBuf, co · 9 unmodified lines
242241
243242 // initialize context in queue
244243 pPicNewBuf->iCapacity = kiNewSize;
245− *ppPicBuf = pPicNewBuf;
244+ * ppPicBuf = pPicNewBuf;
246245
247246 for (int32_t i = 0; i < pPicNewBuf->iCapacity; i++) {
248247 pPicNewBuf->ppPic[i]->bUsedAsRef = false;

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t