From 669e7b7454ccb4088e300965a5e8ff2586f0d0db Mon Sep 17 00:00:00 2001 From: Yaowu Xu Date: Tue, 17 May 2016 17:18:26 -0700 Subject: [PATCH] Prevent invalid read This commit adds a check before reading into RefBuffer to prevent OOB read. BUG=https://bugs.chromium.org/p/chromium/issues/detail?id=612023 (cherry picked from commit 4f0e4d6cef827bc452848e126a6bedc47424da88) Change-Id: I4f0732d4ca92f79b57103bffcff15499073e79a4 --- vp9/decoder/vp9_decodeframe.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/vp9/decoder/vp9_decodeframe.c b/vp9/decoder/vp9_decodeframe.c index 84c757cc7..e1453f87f 100644 --- a/vp9/decoder/vp9_decodeframe.c +++ b/vp9/decoder/vp9_decodeframe.c @@ -1315,11 +1315,16 @@ static void setup_frame_size_with_refs(VP9_COMMON *cm, BufferPool *const pool = cm->buffer_pool; for (i = 0; i < REFS_PER_FRAME; ++i) { if (vpx_rb_read_bit(rb)) { - YV12_BUFFER_CONFIG *const buf = cm->frame_refs[i].buf; - width = buf->y_crop_width; - height = buf->y_crop_height; - found = 1; - break; + if (cm->frame_refs[i].idx != INVALID_IDX) { + YV12_BUFFER_CONFIG *const buf = cm->frame_refs[i].buf; + width = buf->y_crop_width; + height = buf->y_crop_height; + found = 1; + break; + } else { + vpx_internal_error(&cm->error, VPX_CODEC_CORRUPT_FRAME, + "Failed to decode frame size"); + } } }