diff options
author | Hamsalekha S <hamsalekha.s@ittiam.com> | 2017-06-06 10:26:16 +0530 |
---|---|---|
committer | Ivan Kutepov <its.kutepov@gmail.com> | 2017-09-14 23:57:40 +0300 |
commit | 1dacb85853e0881871ba05984373bb18d7f2c149 (patch) | |
tree | f37b36efec2d72be5abebf90b7fee88ece3244d4 /decoder | |
parent | 96936fc01454748878df2d4ac3cea506272c4adc (diff) | |
download | android_external_libavc-1dacb85853e0881871ba05984373bb18d7f2c149.tar.gz android_external_libavc-1dacb85853e0881871ba05984373bb18d7f2c149.tar.bz2 android_external_libavc-1dacb85853e0881871ba05984373bb18d7f2c149.zip |
Initialize DPB structures to valid values.
When the first frame is a B frame, the colocated picture
will now point to the current frame.
Test: run poc with and without this patch
Bug: 38115076
Change-Id: I48a8f128740551d6a9252931dafcf8c629ecad0d
(cherry picked from commit b8d362561e48dde8898eb0415f298d64e76f2b7c)
CVE-2017-0772
Diffstat (limited to 'decoder')
-rw-r--r-- | decoder/ih264d_parse_slice.c | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/decoder/ih264d_parse_slice.c b/decoder/ih264d_parse_slice.c index ab9f3f6..849b9c5 100644 --- a/decoder/ih264d_parse_slice.c +++ b/decoder/ih264d_parse_slice.c @@ -441,11 +441,23 @@ WORD32 ih264d_start_of_pic(dec_struct_t *ps_dec, ps_dec->au1_pic_buf_ref_flag[cur_pic_buf_id] = 0; { - /*make first entry of list0 point to cur pic,so that if first Islice is in error, ref pic struct will have valid entries*/ + /*make first entry of list0 and list1 point to cur pic, + *so that if first slice is in error, ref pic struct will have valid entries*/ ps_dec->ps_ref_pic_buf_lx[0] = ps_dec->ps_dpb_mgr->ps_init_dpb[0]; + ps_dec->ps_ref_pic_buf_lx[1] = ps_dec->ps_dpb_mgr->ps_init_dpb[1]; *(ps_dec->ps_dpb_mgr->ps_init_dpb[0][0]) = *ps_cur_pic; /* Initialize for field reference as well */ *(ps_dec->ps_dpb_mgr->ps_init_dpb[0][MAX_REF_BUFS]) = *ps_cur_pic; + + *(ps_dec->ps_dpb_mgr->ps_mod_dpb[0][0]) = *ps_cur_pic; + /* Initialize for field reference as well */ + *(ps_dec->ps_dpb_mgr->ps_mod_dpb[0][MAX_REF_BUFS]) = *ps_cur_pic; + *(ps_dec->ps_dpb_mgr->ps_init_dpb[1][0]) = *ps_cur_pic; + /* Initialize for field reference as well */ + *(ps_dec->ps_dpb_mgr->ps_init_dpb[1][MAX_REF_BUFS]) = *ps_cur_pic; + *(ps_dec->ps_dpb_mgr->ps_mod_dpb[1][0]) = *ps_cur_pic; + /* Initialize for field reference as well */ + *(ps_dec->ps_dpb_mgr->ps_mod_dpb[1][MAX_REF_BUFS]) = *ps_cur_pic; } if(!ps_dec->ps_cur_pic) |