History

Fix oss-fuzz reported bug 13941 Heap-use-after-free in WelsDec::MapColToList0.

xiaotiansf committed 7 years ago

Commit fbb525f1 parent 72780eb2 files · +9 −3Browse files

Showing the changes to codec/decoder/core/src/decode_slice.cpp (1 of 2 files). Show all

Unified · Split

codec/decoder/core/src/decode_slice.cpp+3−3
@@ -2403,11 +2403,11 @@ int32_t WelsDecodeMbCavlcBSlice (PWelsDecoderContext pCtx, PNalUnit pNalCur, uin · 2402 unmodified lines
2403 pCtx->bMbRefConcealed = pCtx->bRPLRError || pCtx->bMbRefConcealed || ! (ppRefPicL0[0] && ppRefPicL0[0]->bIsComplete)2403 pCtx->bMbRefConcealed = pCtx->bRPLRError || pCtx->bMbRefConcealed || ! (ppRefPicL0[0] && ppRefPicL0[0]->bIsComplete)
2404 || ! (ppRefPicL1[0] && ppRefPicL1[0]->bIsComplete);2404 || ! (ppRefPicL1[0] && ppRefPicL1[0]->bIsComplete);
2405 2405
2406 if (pCtx->bMbRefConcealed) {2406 /*if (pCtx->bMbRefConcealed) {
2407 SLogContext* pLogCtx = & (pCtx->sLogCtx);2407 SLogContext* pLogCtx = & (pCtx->sLogCtx);
2408 WelsLog (pLogCtx, WELS_LOG_ERROR, "Ref Picture for B-Slice is lost, B-Slice decoding cannot be continued!");2408 WelsLog (pLogCtx, WELS_LOG_ERROR, "Ref Picture for B-Slice is lost, B-Slice decoding cannot be continued!");
2409 return GENERATE_ERROR_NO (ERR_LEVEL_SLICE_DATA, ERR_INFO_REFERENCE_PIC_LOST);2409 return GENERATE_ERROR_NO (ERR_LEVEL_SLICE_DATA, ERR_INFO_REFERENCE_PIC_LOST);
2410 }2410 }*/
2411 //predict iMv2411 //predict iMv
2412 SubMbType subMbType;2412 SubMbType subMbType;
2413 if (pSliceHeader->iDirectSpatialMvPredFlag) {2413 if (pSliceHeader->iDirectSpatialMvPredFlag) {
@@ -2467,7 +2467,7 @@ int32_t WelsDecodeMbCavlcBSlice (PWelsDecoderContext pCtx, PNalUnit pNalCur, uin · 53 unmodified lines
2467 if (iUsedBits > (pBs->iBits -2467 if (iUsedBits > (pBs->iBits -
2468 1)) { //When BS incomplete, as long as find it, SHOULD stop decoding to avoid mosaic or crash.2468 1)) { //When BS incomplete, as long as find it, SHOULD stop decoding to avoid mosaic or crash.
2469 WelsLog (& (pCtx->sLogCtx), WELS_LOG_WARNING,2469 WelsLog (& (pCtx->sLogCtx), WELS_LOG_WARNING,
2470 "WelsDecodeMbCavlcISlice()::::pBs incomplete, iUsedBits:%" PRId64 " > pBs->iBits:%d, MUST stop decoding.",2470 "WelsDecodeMbCavlcBSlice()::::pBs incomplete, iUsedBits:%" PRId64 " > pBs->iBits:%d, MUST stop decoding.",
2471 (int64_t)iUsedBits, pBs->iBits);2471 (int64_t)iUsedBits, pBs->iBits);
2472 return GENERATE_ERROR_NO (ERR_LEVEL_MB_DATA, ERR_INFO_BS_INCOMPLETE);2472 return GENERATE_ERROR_NO (ERR_LEVEL_MB_DATA, ERR_INFO_BS_INCOMPLETE);
2473 }2473 }

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t