History

Better way to fix oss-fuzz reported bug 14267 by re-assigning reference's references after memory reallocations in DecreasePicBuff instead of just reset.

xiaotiansf committed 7 years ago

Commit ccb105a1 parent 6aaa51d1 file · +16 −5Browse files

Showing the changes to codec/decoder/core/src/decoder.cpp (1 of 1 file). Show all

Unified · Split

codec/decoder/core/src/decoder.cpp+16−5
@@ -209,13 +209,24 @@ static int32_t DecreasePicBuff (PWelsDecoderContext pCtx, PPicBuff* ppPicBuf, co · 208 unmodified lines
209 iDelIdx = kiNewSize;209 iDelIdx = kiNewSize;
210 }210 }
211 211
212 //remove references212 //update references due to allocation changes
213 for (int32_t i = 0; i < kiNewSize; i++) {213 for (int32_t i = 0; i < kiNewSize; i++) {
214 for (int32_t listIdx = LIST_0; listIdx < LIST_A; ++listIdx) {214 for (int32_t listIdx = LIST_0; listIdx < LIST_A; ++listIdx) {
215 uint32_t j = 0;215 for (int32_t j = 0; j < MAX_DPB_COUNT; j++) {
216 while (j < MAX_DPB_COUNT && pPicNewBuf->ppPic[i]->pRefPic[listIdx][j]) {216 if (pPicNewBuf->ppPic[i]->pRefPic[listIdx][j] != NULL) {
217 pPicNewBuf->ppPic[i]->pRefPic[listIdx][j] = 0;217 unsigned long long uiTimeStamp = pPicNewBuf->ppPic[i]->pRefPic[listIdx][j]->uiTimeStamp;
218 ++j;218 bool foundThePic = false;
219 for (int32_t k = 0; k < kiNewSize; k++) {
220 if (pPicNewBuf->ppPic[k]->uiTimeStamp == uiTimeStamp) {
221 pPicNewBuf->ppPic[i]->pRefPic[listIdx][j] = pPicNewBuf->ppPic[k];
222 foundThePic = true;
223 break;
224 }
225 }
226 if (!foundThePic) {
227 pPicNewBuf->ppPic[i]->pRefPic[listIdx][j] = NULL;
228 }
229 }
219 }230 }
220 }231 }
221 }232 }

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t