diff options
| author | chamarthi.kishore <chamarthi.kishore@ittiam.com> | 2023-02-16 17:18:29 +0530 |
|---|---|---|
| committer | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | 2023-02-16 10:07:46 -0800 |
| commit | 992407f6c3e77c9ff84684c77072b913eaa3152b (patch) | |
| tree | 424c39c4bff1bb0550f7ec25a9d1b766b48470e1 | |
| parent | 7f19ac220647a58262bf08262049f7340030e1bf (diff) | |
| download | libavc-992407f6c3e77c9ff84684c77072b913eaa3152b.tar.gz | |
Resolved invalid memory access to Weighted pred offsets
BUG=oss-fuzz:56013
Test: svc_dec_fuzzer
| -rw-r--r-- | decoder/svc/isvcd_api.c | 2 | ||||
| -rw-r--r-- | decoder/svc/isvcd_parse_epslice.c | 23 |
2 files changed, 1 insertions, 24 deletions
diff --git a/decoder/svc/isvcd_api.c b/decoder/svc/isvcd_api.c index 881ecf5..3ac3984 100644 --- a/decoder/svc/isvcd_api.c +++ b/decoder/svc/isvcd_api.c @@ -5288,7 +5288,7 @@ WORD32 isvcd_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op) ps_dec_op->u4_frame_decoded_flag = 0; ret = isvcd_parse_nal_unit(ps_svc_lyr_dec, ps_cur_node->i4_nal_ref_idc); - if(((ret != OK)) && (u1_res_id != (u1_num_res_lyrs - 1))) + if(ret != OK) { ps_svcd_ctxt->u1_parse_nal_unit_error = 1; break; diff --git a/decoder/svc/isvcd_parse_epslice.c b/decoder/svc/isvcd_parse_epslice.c index dc0e7be..8d8c449 100644 --- a/decoder/svc/isvcd_parse_epslice.c +++ b/decoder/svc/isvcd_parse_epslice.c @@ -3194,12 +3194,7 @@ WORD32 isvcd_parse_interlayer_resamp_func_init(svc_dec_lyr_struct_t *ps_svc_lyr_ { dec_struct_t *ps_dec = &ps_svc_lyr_dec->s_dec; dec_slice_params_t *ps_slice = ps_dec->ps_cur_slice; - svc_dec_ctxt_t *ps_svcd_ctxt = ps_svc_lyr_dec->ps_svcd_ctxt; WORD32 ret = OK; - WORD32 num_mb_skipped; - WORD32 prev_slice_err; - pocstruct_t temp_poc; - WORD32 ht_in_mbs; if(TARGET_LAYER != ps_svc_lyr_dec->u1_layer_identifier) { @@ -3208,9 +3203,6 @@ WORD32 isvcd_parse_interlayer_resamp_func_init(svc_dec_lyr_struct_t *ps_svc_lyr_ ps_slice->i1_slice_beta_offset = ps_svc_lyr_dec->i1_inter_lyr_slice_beta_offset; } - ht_in_mbs = ps_dec->u2_pic_ht >> (4 + ps_dec->ps_cur_slice->u1_field_pic_flag); - num_mb_skipped = (ht_in_mbs * ps_dec->u2_frm_wd_in_mbs) - ps_dec->u2_total_mbs_coded; - if(0 == u2_first_mb_in_slice) { ret = isvcd_populate_res_prms(ps_svc_lyr_dec); @@ -3225,21 +3217,6 @@ WORD32 isvcd_parse_interlayer_resamp_func_init(svc_dec_lyr_struct_t *ps_svc_lyr_ ret = isvcd_residual_samp_res_init(ps_svc_lyr_dec); if(ret != OK) return NOT_OK; } - if(ps_dec->u4_first_slice_in_pic && (ps_dec->u4_pic_buf_got == 0)) - prev_slice_err = 1; - else - prev_slice_err = 2; - - if(ps_dec->u4_first_slice_in_pic && (ps_dec->u2_total_mbs_coded == 0)) prev_slice_err = 1; - - if((ps_svc_lyr_dec->u1_layer_identifier == TARGET_LAYER) && - (1 == ps_svcd_ctxt->u1_parse_nal_unit_error)) - { - ret = isvcd_mark_err_slice_skip( - ps_svc_lyr_dec, num_mb_skipped, ps_dec->u1_nal_unit_type == IDR_SLICE_NAL, - ps_dec->ps_cur_slice->u2_frame_num, &temp_poc, prev_slice_err); - return ret; - } return ret; } |