shithub: libvpx

Info  •  Files  •  Log  •  Branches

Prevent invalid read

This commit adds a check before reading into RefBuffer to prevent OOB
read.

BUG=https://bugs.chromium.org/p/chromium/issues/detail?id=612023

Change-Id: I5b02951932e7f457cfbe6b2e650790496b8577ae

--- a/vp9/decoder/vp9_decodeframe.c

+++ b/vp9/decoder/vp9_decodeframe.c

@@ -1315,11 +1315,16 @@

   BufferPool *const pool = cm->buffer_pool;

   for (i = 0; i < REFS_PER_FRAME; ++i) {

     if (vpx_rb_read_bit(rb)) {

-      YV12_BUFFER_CONFIG *const buf = cm->frame_refs[i].buf;

-      width = buf->y_crop_width;

-      height = buf->y_crop_height;

-      found = 1;

-      break;

+      if (cm->frame_refs[i].idx != INVALID_IDX) {

+        YV12_BUFFER_CONFIG *const buf = cm->frame_refs[i].buf;

+        width = buf->y_crop_width;

+        height = buf->y_crop_height;

+        found = 1;

+        break;

+      } else {

+        vpx_internal_error(&cm->error, VPX_CODEC_CORRUPT_FRAME,

+                           "Failed to decode frame size");

+      }

     }

   }