From 4f0e4d6cef827bc452848e126a6bedc47424da88 Mon Sep 17 00:00:00 2001 From: Yaowu Xu Date: Tue, 17 May 2016 17:18:26 -0700 Subject: [PATCH] Prevent invalid read This commit adds a check before reading into RefBuffer to prevent OOB read. BUG=https://bugs.chromium.org/p/chromium/issues/detail?id=612023 Change-Id: I5b02951932e7f457cfbe6b2e650790496b8577ae --- vp9/decoder/vp9_decodeframe.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/vp9/decoder/vp9_decodeframe.c b/vp9/decoder/vp9_decodeframe.c index 2c2c0ba..30f8b0e 100644 --- a/vp9/decoder/vp9_decodeframe.c +++ b/vp9/decoder/vp9_decodeframe.c @@ -1315,11 +1315,16 @@ static void setup_frame_size_with_refs(VP9_COMMON *cm, BufferPool *const pool = cm->buffer_pool; for (i = 0; i < REFS_PER_FRAME; ++i) { if (vpx_rb_read_bit(rb)) { - YV12_BUFFER_CONFIG *const buf = cm->frame_refs[i].buf; - width = buf->y_crop_width; - height = buf->y_crop_height; - found = 1; - break; + if (cm->frame_refs[i].idx != INVALID_IDX) { + YV12_BUFFER_CONFIG *const buf = cm->frame_refs[i].buf; + width = buf->y_crop_width; + height = buf->y_crop_height; + found = 1; + break; + } else { + vpx_internal_error(&cm->error, VPX_CODEC_CORRUPT_FRAME, + "Failed to decode frame size"); + } } } -- 2.7.4