History

Fix oss-fuzz reported bug 13941 Heap-use-after-free in WelsDec::MapColToList0.

xiaotiansf committed 7 years ago

Commit fbb525f1 parent 72780eb2 files · +9 −3Browse files

Showing the changes to codec/decoder/core/src/decode_slice.cpp (1 of 2 files). Show all

Unified · Split

codec/decoder/core/src/decode_slice.cpp+3−3
@@ -2403,11 +2403,11 @@ int32_t WelsDecodeMbCavlcBSlice (PWelsDecoderContext pCtx, PNalUnit pNalCur, uin · 2402 unmodified lines
24032403 pCtx->bMbRefConcealed = pCtx->bRPLRError || pCtx->bMbRefConcealed || ! (ppRefPicL0[0] && ppRefPicL0[0]->bIsComplete)
24042404 || ! (ppRefPicL1[0] && ppRefPicL1[0]->bIsComplete);
24052405
2406− if (pCtx->bMbRefConcealed) {
2406+ /*if (pCtx->bMbRefConcealed) {
24072407 SLogContext* pLogCtx = & (pCtx->sLogCtx);
24082408 WelsLog (pLogCtx, WELS_LOG_ERROR, "Ref Picture for B-Slice is lost, B-Slice decoding cannot be continued!");
24092409 return GENERATE_ERROR_NO (ERR_LEVEL_SLICE_DATA, ERR_INFO_REFERENCE_PIC_LOST);
2410− }
2410+ }*/
24112411 //predict iMv
24122412 SubMbType subMbType;
24132413 if (pSliceHeader->iDirectSpatialMvPredFlag) {
@@ -2467,7 +2467,7 @@ int32_t WelsDecodeMbCavlcBSlice (PWelsDecoderContext pCtx, PNalUnit pNalCur, uin · 53 unmodified lines
24672467 if (iUsedBits > (pBs->iBits -
24682468 1)) { //When BS incomplete, as long as find it, SHOULD stop decoding to avoid mosaic or crash.
24692469 WelsLog (& (pCtx->sLogCtx), WELS_LOG_WARNING,
2470− "WelsDecodeMbCavlcISlice()::::pBs incomplete, iUsedBits:%" PRId64 " > pBs->iBits:%d, MUST stop decoding.",
2470+ "WelsDecodeMbCavlcBSlice()::::pBs incomplete, iUsedBits:%" PRId64 " > pBs->iBits:%d, MUST stop decoding.",
24712471 (int64_t)iUsedBits, pBs->iBits);
24722472 return GENERATE_ERROR_NO (ERR_LEVEL_MB_DATA, ERR_INFO_BS_INCOMPLETE);
24732473 }

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t