diff options
| author | Hamsalekha S <hamsalekha.s@ittiam.com> | 2017-02-21 15:47:02 +0530 |
|---|---|---|
| committer | MSe <mse1969@posteo.de> | 2017-07-07 11:21:46 +0200 |
| commit | 5b96c82ab152fa023a11de8e58b86e1c3da6d796 (patch) | |
| tree | 12ba99206efcaed9833afdc6d91dbc0cb5c4030e | |
| parent | 86d5e685a4e32f1d146f10e29f818bd27fc04b3d (diff) | |
| download | android_external_libavc-5b96c82ab152fa023a11de8e58b86e1c3da6d796.tar.gz android_external_libavc-5b96c82ab152fa023a11de8e58b86e1c3da6d796.tar.bz2 android_external_libavc-5b96c82ab152fa023a11de8e58b86e1c3da6d796.zip | |
Fix in the case of MMCO 3 (long term reference idx).
Increment number of long term reference buffers only when both top field
and bottom field have been set as long term.
[backport for M/N from master]
Bug: 35584425
Test: ran POC - no hang, no segfault.
AOSP-Change-Id: I94e3857944da675eda38f8e1a9bd887f48bff524
(cherry picked from commit 6fa5df8811ea0b8e8459f86dd3c30bf7a9b39482)
(cherry picked from commit 46e96d40dbca2896b5e20cf48d14798231c97663)
CVE-2017-0688
Change-Id: I3f4077df0fc0764b70c93cb226a5c7503799ba26
| -rw-r--r-- | decoder/ih264d_dpb_mgr.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/decoder/ih264d_dpb_mgr.c b/decoder/ih264d_dpb_mgr.c index a75aeee..e02cc90 100644 --- a/decoder/ih264d_dpb_mgr.c +++ b/decoder/ih264d_dpb_mgr.c @@ -291,6 +291,8 @@ WORD32 ih264d_insert_lt_node(dpb_manager_t *ps_dpb_mgr, ps_mov_node->s_bot_field.u1_reference_info = IS_LONG_TERM; ps_mov_node->s_top_field.u1_long_term_frame_idx = u4_lt_idx; ps_mov_node->s_bot_field.u1_long_term_frame_idx = u4_lt_idx; + u1_mark_bot_field_long_term = 1; + u1_mark_top_field_long_term = 1; } ps_mov_node->u1_lt_idx = u4_lt_idx; //Assign the LT index to the node @@ -337,7 +339,7 @@ WORD32 ih264d_insert_lt_node(dpb_manager_t *ps_dpb_mgr, /* Increment LT buf count only if new LT node inserted */ /* If Increment during top_field is done, don't increment */ /* for bottom field, as both them are part of same pic. */ - if(!u1_mark_bot_field_long_term) + if(u1_mark_bot_field_long_term) ps_dpb_mgr->u1_num_lt_ref_bufs++; } |