shithub: dav1d

Info  •  Files  •  Log  •  Branches

decode: error out on missing reference frames

Fixes segfaults with
david-fuzzing-data:artifacts/crash-b9015ad03b63131c25016592c3535da1268a08ad.

--- a/src/decode.c

+++ b/src/decode.c

@@ -2775,6 +2775,11 @@

         }

         for (int i = 0; i < 7; i++) {

             const int refidx = f->frame_hdr.refidx[i];

+            if (!c->refs[refidx].p.p.data[0]) {

+                for (int j = 0; j < i; j++)

+                    dav1d_thread_picture_unref(&f->refp[j]);

+                return -EINVAL;

+            }

             dav1d_thread_picture_ref(&f->refp[i], &c->refs[refidx].p);

         }

     }