shithub: libvpx

Download patch

ref: c0856b98ccec175a8dd211f6c64bb2b64ee161e7
parent: 127f0a0c5f16851aa60d8b13b884cc39516963b3
parent: 1bd69ac57f09c1bafc2629171f53c86bfdb469e2
author: Yaowu Xu <yaowu@google.com>
date: Thu Jan 30 04:34:18 EST 2014 

Merge "Fixing out of bounds access in frame_refs[] array."


--- a/vp9/encoder/vp9_onyx_int.h
+++ b/vp9/encoder/vp9_onyx_int.h
@@ -756,8 +756,10 @@
 
 static void set_ref_ptrs(VP9_COMMON *cm, MACROBLOCKD *xd,
                          MV_REFERENCE_FRAME ref0, MV_REFERENCE_FRAME ref1) {
-  xd->block_refs[0] = &cm->frame_refs[ref0 - LAST_FRAME];
-  xd->block_refs[1] = &cm->frame_refs[ref1 - LAST_FRAME];
+  xd->block_refs[0] = &cm->frame_refs[ref0 >= LAST_FRAME ? ref0 - LAST_FRAME
+                                                         : 0];
+  xd->block_refs[1] = &cm->frame_refs[ref1 >= LAST_FRAME ? ref1 - LAST_FRAME
+                                                         : 0];
 }
 
 #ifdef __cplusplus