Commit 3caed4f8 authored by James Zern's avatar James Zern
Browse files

get_ref_frame: check ref_frame_map value

'ref_frame_map' is initialized to -1. avoids using an invalid index  if
VP9_GET_REFERENCE/VP8_COPY_REFERENCE controls are issued after a decode
error.

Change-Id: I4599762c4d0b07a5943a72bf4a86ccb596cc062a
parent 7d9da93a
......@@ -81,6 +81,24 @@ void TestVp9Controls(vpx_codec_ctx_t *dec) {
EXPECT_EQ(VPX_CODEC_INVALID_PARAM,
vpx_codec_control_(dec, kControls[i], NULL));
}
vp9_ref_frame_t ref;
ref.idx = 0;
EXPECT_EQ(VPX_CODEC_ERROR, vpx_codec_control(dec, VP9_GET_REFERENCE, &ref));
EXPECT_EQ(VPX_CODEC_INVALID_PARAM,
vpx_codec_control(dec, VP9_GET_REFERENCE, NULL));
vpx_ref_frame_t ref_copy;
const int width = 352;
const int height = 288;
ASSERT_TRUE(
vpx_img_alloc(&ref_copy.img, VPX_IMG_FMT_I420, width, height, 1) != NULL);
ref_copy.frame_type = VP8_LAST_FRAME;
EXPECT_EQ(VPX_CODEC_ERROR,
vpx_codec_control(dec, VP8_COPY_REFERENCE, &ref_copy));
EXPECT_EQ(VPX_CODEC_INVALID_PARAM,
vpx_codec_control(dec, VP8_COPY_REFERENCE, NULL));
vpx_img_free(&ref_copy.img);
}
TEST(DecodeAPI, Vp9InvalidDecode) {
......
......@@ -205,6 +205,9 @@ typedef struct VP9Common {
static INLINE YV12_BUFFER_CONFIG *get_ref_frame(VP9_COMMON *cm, int index) {
if (index < 0 || index >= REF_FRAMES)
return NULL;
if (cm->ref_frame_map[index] < 0)
return NULL;
assert(cm->ref_frame_map[index] < REF_FRAMES);
return &cm->frame_bufs[cm->ref_frame_map[index]].buf;
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment