shithub: openh264

Info  •  Files  •  Log  •  Branches

Fix oss-fuzz newly reported bug 14267. reset reference's references after call DecreasePicBuff when new sequence arrives

--- a/codec/decoder/core/src/decoder.cpp

+++ b/codec/decoder/core/src/decoder.cpp

@@ -228,6 +228,14 @@

     pPicNewBuf->ppPic[i]->uiRefCount = 0;

     pPicNewBuf->ppPic[i]->bAvailableFlag = true;

     pPicNewBuf->ppPic[i]->bIsComplete = false;

+    //remove references

+    for (int32_t listIdx = LIST_0; listIdx < LIST_A; ++listIdx) {

+      uint32_t i = 0;

+      while (i < MAX_DPB_COUNT && pPicNewBuf->ppPic[i]->pRefPic[listIdx][i]) {

+        pPicNewBuf->ppPic[i]->pRefPic[listIdx][i] = 0;

+        ++i;

+      }

+    }

   }

   // remove old PicBuf

   if (pPicOldBuf->ppPic != NULL) {