shithub: libvpx

Info  •  Files  •  Log  •  Branches

get_ref_frame: check ref_frame_map value

'ref_frame_map' is initialized to -1. avoids using an invalid index  if
VP9_GET_REFERENCE/VP8_COPY_REFERENCE controls are issued after a decode
error.

Change-Id: I4599762c4d0b07a5943a72bf4a86ccb596cc062a

--- a/test/decode_api_test.cc

+++ b/test/decode_api_test.cc

@@ -81,6 +81,24 @@

     EXPECT_EQ(VPX_CODEC_INVALID_PARAM,

               vpx_codec_control_(dec, kControls[i], NULL));

   }

+

+  vp9_ref_frame_t ref;

+  ref.idx = 0;

+  EXPECT_EQ(VPX_CODEC_ERROR, vpx_codec_control(dec, VP9_GET_REFERENCE, &ref));

+  EXPECT_EQ(VPX_CODEC_INVALID_PARAM,

+            vpx_codec_control(dec, VP9_GET_REFERENCE, NULL));

+

+  vpx_ref_frame_t ref_copy;

+  const int width = 352;

+  const int height = 288;

+  ASSERT_TRUE(

+      vpx_img_alloc(&ref_copy.img, VPX_IMG_FMT_I420, width, height, 1) != NULL);

+  ref_copy.frame_type = VP8_LAST_FRAME;

+  EXPECT_EQ(VPX_CODEC_ERROR,

+            vpx_codec_control(dec, VP8_COPY_REFERENCE, &ref_copy));

+  EXPECT_EQ(VPX_CODEC_INVALID_PARAM,

+            vpx_codec_control(dec, VP8_COPY_REFERENCE, NULL));

+  vpx_img_free(&ref_copy.img);

 }

 TEST(DecodeAPI, Vp9InvalidDecode) {

--- a/vp9/common/vp9_onyxc_int.h

+++ b/vp9/common/vp9_onyxc_int.h

@@ -205,6 +205,9 @@

 static INLINE YV12_BUFFER_CONFIG *get_ref_frame(VP9_COMMON *cm, int index) {

   if (index < 0 || index >= REF_FRAMES)

     return NULL;

+  if (cm->ref_frame_map[index] < 0)

+    return NULL;

+  assert(cm->ref_frame_map[index] < REF_FRAMES);

   return &cm->frame_bufs[cm->ref_frame_map[index]].buf;

 }

-- 

⑨