diff options
| author | Hamsalekha S <hamsalekha.s@ittiam.com> | 2017-03-20 17:00:11 +0530 |
|---|---|---|
| committer | MSe <mse1969@posteo.de> | 2017-07-07 00:07:05 +0200 |
| commit | e04dd6518b85522a26f5d019a9d7db3b419b34ec (patch) | |
| tree | 5641ca5687b0a7d4b76da7b01fa890b8b90db5e6 | |
| parent | c707af6e75bcdf6a03f0bbfddd4b80bae4e0e936 (diff) | |
| download | android_external_libavc-e04dd6518b85522a26f5d019a9d7db3b419b34ec.tar.gz android_external_libavc-e04dd6518b85522a26f5d019a9d7db3b419b34ec.tar.bz2 android_external_libavc-e04dd6518b85522a26f5d019a9d7db3b419b34ec.zip | |
Decoder: Fix in reference list initialization.
In the case of error, initialize the new reference list1 with the first
picture in default list0 instead of default list1, as first picture in
list1 could still be invalid.
Bug: 36035074
AOSP-Change-Id: I7ab493ee7a157cbefcd4da8389ff1ff899c16b7f
(cherry picked from commit 93954f5e9a5d727e402921ac6fa100e6dcc1d4e8)
CVE-2017-0677
Change-Id: I6e3d02457961d222fa721e2d8d283a989302805d
| -rw-r--r-- | decoder/ih264d_process_bslice.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/decoder/ih264d_process_bslice.c b/decoder/ih264d_process_bslice.c index 4c5ee05..7784110 100644 --- a/decoder/ih264d_process_bslice.c +++ b/decoder/ih264d_process_bslice.c @@ -1494,7 +1494,7 @@ void ih264d_init_ref_idx_lx_b(dec_struct_t *ps_dec) UWORD8 u1_i; pic_buffer_t *ps_ref_pic; - ps_ref_pic = ps_dpb_mgr->ps_init_dpb[1][0] + MAX_REF_BUFS; + ps_ref_pic = ps_dpb_mgr->ps_init_dpb[0][0] + MAX_REF_BUFS; if(NULL == ps_ref_pic->pu1_buf1) { @@ -1521,7 +1521,7 @@ void ih264d_init_ref_idx_lx_b(dec_struct_t *ps_dec) UWORD8 u1_i; pic_buffer_t *ps_ref_pic; - ps_ref_pic = ps_dpb_mgr->ps_init_dpb[1][0]; + ps_ref_pic = ps_dpb_mgr->ps_init_dpb[0][0]; if(NULL == ps_ref_pic->pu1_buf1) { |