From 3caed4f8fdecaf2a9f4faf591f7c3f7cd739ce8f Mon Sep 17 00:00:00 2001 From: James Zern Date: Sat, 9 Aug 2014 18:54:28 -0700 Subject: [PATCH] get_ref_frame: check ref_frame_map value 'ref_frame_map' is initialized to -1. avoids using an invalid index if VP9_GET_REFERENCE/VP8_COPY_REFERENCE controls are issued after a decode error. Change-Id: I4599762c4d0b07a5943a72bf4a86ccb596cc062a --- test/decode_api_test.cc | 18 ++++++++++++++++++ vp9/common/vp9_onyxc_int.h | 3 +++ 2 files changed, 21 insertions(+) diff --git a/test/decode_api_test.cc b/test/decode_api_test.cc index 06790645f..72fdfc7bc 100644 --- a/test/decode_api_test.cc +++ b/test/decode_api_test.cc @@ -81,6 +81,24 @@ void TestVp9Controls(vpx_codec_ctx_t *dec) { EXPECT_EQ(VPX_CODEC_INVALID_PARAM, vpx_codec_control_(dec, kControls[i], NULL)); } + + vp9_ref_frame_t ref; + ref.idx = 0; + EXPECT_EQ(VPX_CODEC_ERROR, vpx_codec_control(dec, VP9_GET_REFERENCE, &ref)); + EXPECT_EQ(VPX_CODEC_INVALID_PARAM, + vpx_codec_control(dec, VP9_GET_REFERENCE, NULL)); + + vpx_ref_frame_t ref_copy; + const int width = 352; + const int height = 288; + ASSERT_TRUE( + vpx_img_alloc(&ref_copy.img, VPX_IMG_FMT_I420, width, height, 1) != NULL); + ref_copy.frame_type = VP8_LAST_FRAME; + EXPECT_EQ(VPX_CODEC_ERROR, + vpx_codec_control(dec, VP8_COPY_REFERENCE, &ref_copy)); + EXPECT_EQ(VPX_CODEC_INVALID_PARAM, + vpx_codec_control(dec, VP8_COPY_REFERENCE, NULL)); + vpx_img_free(&ref_copy.img); } TEST(DecodeAPI, Vp9InvalidDecode) { diff --git a/vp9/common/vp9_onyxc_int.h b/vp9/common/vp9_onyxc_int.h index ae32aff7d..dff077c11 100644 --- a/vp9/common/vp9_onyxc_int.h +++ b/vp9/common/vp9_onyxc_int.h @@ -205,6 +205,9 @@ typedef struct VP9Common { static INLINE YV12_BUFFER_CONFIG *get_ref_frame(VP9_COMMON *cm, int index) { if (index < 0 || index >= REF_FRAMES) return NULL; + if (cm->ref_frame_map[index] < 0) + return NULL; + assert(cm->ref_frame_map[index] < REF_FRAMES); return &cm->frame_bufs[cm->ref_frame_map[index]].buf; } -- 2.40.0