History

Better way to fix oss-fuzz reported bug 14267 by re-assigning reference's references after memory reallocations in DecreasePicBuff instead of just reset.

xiaotiansf committed 7 years ago

Commit ccb105a1 parent 6aaa51d1 file · +16 −5Browse files

Showing the changes to codec/decoder/core/src/decoder.cpp (1 of 1 file). Show all

Unified · Split

codec/decoder/core/src/decoder.cpp+16−5
@@ -209,13 +209,24 @@ static int32_t DecreasePicBuff (PWelsDecoderContext pCtx, PPicBuff* ppPicBuf, co · 208 unmodified lines
209209 iDelIdx = kiNewSize;
210210 }
211211
212− //remove references
212+ //update references due to allocation changes
213213 for (int32_t i = 0; i < kiNewSize; i++) {
214214 for (int32_t listIdx = LIST_0; listIdx < LIST_A; ++listIdx) {
215− uint32_t j = 0;
216− while (j < MAX_DPB_COUNT && pPicNewBuf->ppPic[i]->pRefPic[listIdx][j]) {
217− pPicNewBuf->ppPic[i]->pRefPic[listIdx][j] = 0;
218− ++j;
215+ for (int32_t j = 0; j < MAX_DPB_COUNT; j++) {
216+ if (pPicNewBuf->ppPic[i]->pRefPic[listIdx][j] != NULL) {
217+ unsigned long long uiTimeStamp = pPicNewBuf->ppPic[i]->pRefPic[listIdx][j]->uiTimeStamp;
218+ bool foundThePic = false;
219+ for (int32_t k = 0; k < kiNewSize; k++) {
220+ if (pPicNewBuf->ppPic[k]->uiTimeStamp == uiTimeStamp) {
221+ pPicNewBuf->ppPic[i]->pRefPic[listIdx][j] = pPicNewBuf->ppPic[k];
222+ foundThePic = true;
223+ break;
224+ }
225+ }
226+ if (!foundThePic) {
227+ pPicNewBuf->ppPic[i]->pRefPic[listIdx][j] = NULL;
228+ }
229+ }
219230 }
220231 }
221232 }

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t