shithub: libvpx

Info  •  Files  •  Log  •  Branches

Merge "Changed validation of reference frame size"

--- a/vp9/decoder/vp9_decodeframe.c

+++ b/vp9/decoder/vp9_decodeframe.c

@@ -662,6 +662,7 @@

                                        struct vp9_read_bit_buffer *rb) {

   int width, height;

   int found = 0, i;

+  int has_valid_ref_frame = 0;

   for (i = 0; i < REFS_PER_FRAME; ++i) {

     if (vp9_rb_read_bit(rb)) {

       YV12_BUFFER_CONFIG *const buf = cm->frame_refs[i].buf;

@@ -675,15 +676,21 @@

   if (!found)

     vp9_read_frame_size(rb, &width, &height);

-  // Check that each of the frames that this frame references has valid

-  // dimensions.

+  if (width <=0 || height <= 0)

+    vpx_internal_error(&cm->error, VPX_CODEC_CORRUPT_FRAME,

+                       "Invalid frame size");

+

+  // Check to make sure at least one of frames that this frame references

+  // has valid dimensions.

   for (i = 0; i < REFS_PER_FRAME; ++i) {

     RefBuffer *const ref_frame = &cm->frame_refs[i];

-    if (!valid_ref_frame_size(ref_frame->buf->y_width, ref_frame->buf->y_height,

-                              width, height))

-      vpx_internal_error(&cm->error, VPX_CODEC_CORRUPT_FRAME,

-                         "Referenced frame has invalid size");

+    has_valid_ref_frame |= valid_ref_frame_size(ref_frame->buf->y_width,

+                                                ref_frame->buf->y_height,

+                                                width, height);

   }

+  if (!has_valid_ref_frame)

+    vpx_internal_error(&cm->error, VPX_CODEC_CORRUPT_FRAME,

+                       "Referenced frame has invalid size");

   resize_context_buffers(cm, width, height);

   setup_display_size(cm, rb);

--- a/vp9/decoder/vp9_decodemv.c

+++ b/vp9/decoder/vp9_decodemv.c

@@ -435,6 +435,11 @@

   for (ref = 0; ref < 1 + is_compound; ++ref) {

     const MV_REFERENCE_FRAME frame = mbmi->ref_frame[ref];

+    const int ref_idx = frame - LAST_FRAME;

+    if (cm->frame_refs[ref_idx].sf.x_scale_fp == REF_INVALID_SCALE ||

+        cm->frame_refs[ref_idx].sf.y_scale_fp == REF_INVALID_SCALE )

+      vpx_internal_error(&cm->error, VPX_CODEC_UNSUP_BITSTREAM,

+                         "Reference frame has invalid dimensions");

     vp9_find_mv_refs(cm, xd, tile, mi, frame, mbmi->ref_mvs[frame],

                      mi_row, mi_col);

   }

-- 

⑨