shithub: openh264

Download patch

ref: da8dd9d9b32b42472cd8ca8f81c301482d24d73b
parent: 316a3ba3a7f4770198c66830536474801e1fd5ed
parent: f742970055bd48405a4ef7bd6949bf6d16325d98
author: huili2 <huili2@cisco.com>
date: Fri Jan 25 09:10:19 EST 2019 

Merge pull request #3089 from xiaotiansf/NewBugzilla

Fix some newly Bugzilla reported bugs


--- a/codec/decoder/core/src/parse_mb_syn_cabac.cpp
+++ b/codec/decoder/core/src/parse_mb_syn_cabac.cpp
@@ -882,6 +882,11 @@
     uint32_t uiSubMbType;
     //sub_mb_type, partition
     int16_t pMvDirect[LIST_A][2] = { {0, 0}, {0, 0} };
+    if (pCtx->sRefPic.pRefList[LIST_1][0] == NULL) {
+      SLogContext* pLogCtx = & (pCtx->sLogCtx);
+      WelsLog (pLogCtx, WELS_LOG_ERROR, "Colocated Ref Picture for B-Slice is lost, B-Slice decoding cannot be continued!");
+      return GENERATE_ERROR_NO (ERR_LEVEL_SLICE_DATA, ERR_INFO_REFERENCE_PIC_LOST);
+    }
     bool bIsLongRef = pCtx->sRefPic.pRefList[LIST_1][0]->bIsLongRef;
     const int32_t ref0Count = WELS_MIN (pSliceHeader->uiRefCount[LIST_0], pCtx->sRefPic.uiRefCount[LIST_0]);
     bool has_direct_called = false;
@@ -888,7 +893,7 @@
     SubMbType directSubMbType = 0;
     for (int32_t i = 0; i < 4; i++) {
       WELS_READ_VERIFY (ParseBSubMBTypeCabac (pCtx, pNeighAvail, uiSubMbType));
-      if (uiSubMbType > 13) { //invalid sub_mb_type
+      if (uiSubMbType >= 13) { //invalid sub_mb_type
         return GENERATE_ERROR_NO (ERR_LEVEL_MB_DATA, ERR_INFO_INVALID_SUB_MB_TYPE);
       }
 //      pCurDqLayer->pSubMbType[iMbXy][i] = g_ksInterBSubMbTypeInfo[uiSubMbType].iType;
--- a/codec/decoder/core/src/parse_mb_syn_cavlc.cpp
+++ b/codec/decoder/core/src/parse_mb_syn_cavlc.cpp
@@ -1528,6 +1528,11 @@
     uint32_t uiSubMbType;
     //sub_mb_type, partition
     int16_t pMvDirect[LIST_A][2] = { { 0, 0 }, { 0, 0 } };
+    if (pCtx->sRefPic.pRefList[LIST_1][0] == NULL) {
+      SLogContext* pLogCtx = & (pCtx->sLogCtx);
+      WelsLog (pLogCtx, WELS_LOG_ERROR, "Colocated Ref Picture for B-Slice is lost, B-Slice decoding cannot be continued!");
+      return GENERATE_ERROR_NO (ERR_LEVEL_SLICE_DATA, ERR_INFO_REFERENCE_PIC_LOST);
+    }
     bool bIsLongRef = pCtx->sRefPic.pRefList[LIST_1][0]->bIsLongRef;
     const int32_t ref0Count = WELS_MIN (pSliceHeader->uiRefCount[LIST_0], pCtx->sRefPic.uiRefCount[LIST_0]);
     bool has_direct_called = false;
@@ -1537,7 +1542,7 @@
     for (int32_t i = 0; i < 4; i++) {
       WELS_READ_VERIFY (BsGetUe (pBs, &uiCode)); //sub_mb_type[ mbPartIdx ]
       uiSubMbType = uiCode;
-      if (uiSubMbType > 13) { //invalid uiSubMbType
+      if (uiSubMbType >= 13) { //invalid uiSubMbType
         return GENERATE_ERROR_NO (ERR_LEVEL_MB_DATA, ERR_INFO_INVALID_SUB_MB_TYPE);
       }
       pSubPartCount[i] = g_ksInterBSubMbTypeInfo[uiSubMbType].iPartCount;
--- a/codec/decoder/plus/src/welsDecoderExt.cpp
+++ b/codec/decoder/plus/src/welsDecoderExt.cpp
@@ -690,7 +690,8 @@
     ppDst[1] = m_sPictInfoList[m_iPictInfoIndex].pData[1];
     ppDst[2] = m_sPictInfoList[m_iPictInfoIndex].pData[2];
     m_sPictInfoList[m_iPictInfoIndex].iPOC = sIMinInt32;
-    m_pDecContext->pPicBuff->ppPic[m_sPictInfoList[m_iPictInfoIndex].iPicBuffIdx]->bAvailableFlag = true;
+    if (m_sPictInfoList[m_iPictInfoIndex].iPicBuffIdx < m_pDecContext->pPicBuff->iCapacity)
+      m_pDecContext->pPicBuff->ppPic[m_sPictInfoList[m_iPictInfoIndex].iPicBuffIdx]->bAvailableFlag = true;
     m_sPictInfoList[m_iPictInfoIndex].bLastGOP = false;
     m_iMinPOC = sIMinInt32;
     --m_iNumOfPicts;
@@ -797,7 +798,8 @@
       ppDst[1] = m_sPictInfoList[m_iPictInfoIndex].pData[1];
       ppDst[2] = m_sPictInfoList[m_iPictInfoIndex].pData[2];
       m_sPictInfoList[m_iPictInfoIndex].iPOC = sIMinInt32;
-      m_pDecContext->pPicBuff->ppPic[m_sPictInfoList[m_iPictInfoIndex].iPicBuffIdx]->bAvailableFlag = true;
+      if (m_sPictInfoList[m_iPictInfoIndex].iPicBuffIdx < m_pDecContext->pPicBuff->iCapacity)
+        m_pDecContext->pPicBuff->ppPic[m_sPictInfoList[m_iPictInfoIndex].iPicBuffIdx]->bAvailableFlag = true;
       m_sPictInfoList[m_iPictInfoIndex].bLastGOP = false;
       m_iMinPOC = sIMinInt32;
       --m_iNumOfPicts;
@@ -834,7 +836,8 @@
         ppDst[1] = m_sPictInfoList[m_iPictInfoIndex].pData[1];
         ppDst[2] = m_sPictInfoList[m_iPictInfoIndex].pData[2];
         m_sPictInfoList[m_iPictInfoIndex].iPOC = sIMinInt32;
-        m_pDecContext->pPicBuff->ppPic[m_sPictInfoList[m_iPictInfoIndex].iPicBuffIdx]->bAvailableFlag = true;
+        if (m_sPictInfoList[m_iPictInfoIndex].iPicBuffIdx < m_pDecContext->pPicBuff->iCapacity)
+          m_pDecContext->pPicBuff->ppPic[m_sPictInfoList[m_iPictInfoIndex].iPicBuffIdx]->bAvailableFlag = true;
         m_sPictInfoList[m_iPictInfoIndex].bLastGOP = false;
         m_iMinPOC = sIMinInt32;
         --m_iNumOfPicts;