diff options
| author | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | 2016-12-15 18:04:53 +0530 |
|---|---|---|
| committer | MSe <mse1969@posteo.de> | 2017-05-19 10:31:24 +0200 |
| commit | a082d436bba350696fcf2fc24c0fe219fc216dde (patch) | |
| tree | 3274c6697252616cbe0ecd3b3d5d3da62103acea /decoder | |
| parent | 54bd23ea0824f49d69833de44029e7df1dae436f (diff) | |
| download | android_external_libavc-a082d436bba350696fcf2fc24c0fe219fc216dde.tar.gz android_external_libavc-a082d436bba350696fcf2fc24c0fe219fc216dde.tar.bz2 android_external_libavc-a082d436bba350696fcf2fc24c0fe219fc216dde.zip | |
Decoder: Fixed error handling for dangling fields
In case of dangling fields with gaps in frames enabled,
field pic in cur_slice was wrongly set to 0.
This would cause dangling field to be concealed as a frame, which would
result in a number of MB mismatch and hence a hang.
Bug: 34097672
AOSP-Change-Id: Ia9b7f72c4676188c45790b2dfbb4fe2c2d2c01f8
(cherry picked from commit 1a13168ca3510ba91274d10fdee46b3642cc9554)
CVE-2017-0591
Change-Id: I4087c11d52a5c72c75cb4b992f67ccff63b5d509
Diffstat (limited to 'decoder')
| -rw-r--r-- | decoder/ih264d_utils.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/decoder/ih264d_utils.c b/decoder/ih264d_utils.c index bc5c484..8d02d0e 100644 --- a/decoder/ih264d_utils.c +++ b/decoder/ih264d_utils.c @@ -1557,7 +1557,6 @@ WORD32 ih264d_decode_gaps_in_frame_num(dec_struct_t *ps_dec, ps_cur_slice = ps_dec->ps_cur_slice; ps_pic_params = ps_dec->ps_cur_pps; - ps_cur_slice->u1_field_pic_flag = 0; i4_frame_gaps = 0; ps_dpb_mgr = ps_dec->ps_dpb_mgr; |