diff options
| author | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | 2016-12-20 11:13:55 +0530 |
|---|---|---|
| committer | Sean McCreary <mccreary@mcwest.org> | 2017-03-22 12:25:51 -0600 |
| commit | b1cc26bf13e35f11cd22fa39235a4f2335f2e714 (patch) | |
| tree | cc8fbafa865a71fd7191d1fcc670d95b613fb9e1 | |
| parent | 4286bb3f8d79faeb0de9f9302d52c06b5b503a04 (diff) | |
| download | android_external_libavc-b1cc26bf13e35f11cd22fa39235a4f2335f2e714.tar.gz android_external_libavc-b1cc26bf13e35f11cd22fa39235a4f2335f2e714.tar.bz2 android_external_libavc-b1cc26bf13e35f11cd22fa39235a4f2335f2e714.zip | |
Decoder: Fix in error concealment in the case of Mbaff clips
In case of MBAff clips, if error is detected after parsing odd MB,
then treat that odd MB also as error. All MBAff processing is done
as an MB-Pair.
Bug: 33298089
CVE-2017-0482
CVE-2017-0484
Change-Id: I5242064dadec93333123309cea4c8a8676a2e727
(cherry picked from commit 3ebff7dc62f6fb93d9635dd052c1140ddcc63dc7)
(cherry picked from commit a467b1fb2956fdcee5636ab63573a4bca8150dbe)
| -rw-r--r-- | decoder/ih264d_parse_pslice.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/decoder/ih264d_parse_pslice.c b/decoder/ih264d_parse_pslice.c index cb91279..efb94ad 100644 --- a/decoder/ih264d_parse_pslice.c +++ b/decoder/ih264d_parse_pslice.c @@ -1586,8 +1586,13 @@ WORD32 ih264d_mark_err_slice_skip(dec_struct_t * ps_dec, { // Slice data corrupted // in the case of mbaff, conceal from the even mb. - u1_num_mbs = (ps_dec->u4_num_mbs_cur_nmb >> u1_mbaff ) << u1_mbaff; + if((u1_mbaff) && (ps_dec->u4_num_mbs_cur_nmb & 1)) + { + ps_dec->u4_num_mbs_cur_nmb = ps_dec->u4_num_mbs_cur_nmb - 1; + ps_dec->u2_cur_mb_addr--; + } + u1_num_mbs = ps_dec->u4_num_mbs_cur_nmb; if(u1_num_mbs) { ps_cur_mb_info = ps_dec->ps_nmb_info + u1_num_mbs - 1; |