shithub: libvpx

Download patch

ref: 447c6433b9a3d1c8dfa9f42e924ebd2f605ca250
parent: fdc198c9dea53b5518e8a624a059bb8f86e66c85
parent: 99230aeb0526e13056d8392ba91b1a73c3caabe6
author: Yaowu Xu <yaowu@google.com>
date: Wed Apr 16 11:41:04 EDT 2014

Merge "Prevent reading of uninitialized value"

--- a/vp8/decoder/decodeframe.c
+++ b/vp8/decoder/decodeframe.c
@@ -631,9 +631,17 @@
             xd->dst.u_buffer = dst_buffer[1] + recon_uvoffset;
             xd->dst.v_buffer = dst_buffer[2] + recon_uvoffset;
 
-            xd->pre.y_buffer = ref_buffer[xd->mode_info_context->mbmi.ref_frame][0] + recon_yoffset;
-            xd->pre.u_buffer = ref_buffer[xd->mode_info_context->mbmi.ref_frame][1] + recon_uvoffset;
-            xd->pre.v_buffer = ref_buffer[xd->mode_info_context->mbmi.ref_frame][2] + recon_uvoffset;
+            if (xd->mode_info_context->mbmi.ref_frame >= LAST_FRAME) {
+              MV_REFERENCE_FRAME ref = xd->mode_info_context->mbmi.ref_frame;
+              xd->pre.y_buffer = ref_buffer[ref][0] + recon_yoffset;
+              xd->pre.u_buffer = ref_buffer[ref][1] + recon_uvoffset;
+              xd->pre.v_buffer = ref_buffer[ref][2] + recon_uvoffset;
+            } else {
+              // ref_frame is INTRA_FRAME, pre buffer should not be used.
+              xd->pre.y_buffer = 0;
+              xd->pre.u_buffer = 0;
+              xd->pre.v_buffer = 0;
+            }
 
             /* propagate errors from reference frames */
             xd->corrupted |= ref_fb_corrupted[xd->mode_info_context->mbmi.ref_frame];
--