commit 3ff57a636abb7f0eca287a17613e8808540e8430
author Yaowu Xu <yaowu@google.com> Wed Aug 29 10:50:57 2018 -0700
committer Yaowu Xu <yaowu@google.com> Thu Aug 30 00:12:24 2018 +0000
tree b34084d1a439c8f51823db4abc19b9ab623965eb
parent 8eec652c6cfc8425c89e6eb83498d954dc738ee9

Move frame type validation to right place

This commit moves the validation of frame type to immediately after
the decoding of frame type, so to detect corrupt frame early and stop
decoding.

BUG=oss-fuzz:10052,oss-fuzz:10049

Change-Id: Ia39a7338f96717e1464578d13e70a95fa63b82f5

av1/decoder/decodeframe.c

diff --git a/av1/decoder/decodeframe.c b/av1/decoder/decodeframe.c
index 3f5afe9..0dafce7 100644
--- a/av1/decoder/decodeframe.c
+++ b/av1/decoder/decodeframe.c
@@ -4476,6 +4476,16 @@
     }
 
     cm->frame_type = (FRAME_TYPE)aom_rb_read_literal(rb, 2);  // 2 bits
+    if (pbi->sequence_header_changed) {
+      if (pbi->common.frame_type == KEY_FRAME) {
+        // This is the start of a new coded video sequence.
+        pbi->sequence_header_changed = 0;
+      } else {
+        aom_internal_error(&cm->error, AOM_CODEC_CORRUPT_FRAME,
+                           "Sequence header has changed without a keyframe.");
+      }
+    }
+
     cm->show_frame = aom_rb_read_bit(rb);
     if (seq_params->still_picture &&
         (cm->frame_type != KEY_FRAME || !cm->show_frame)) {

av1/decoder/obu.c

diff --git a/av1/decoder/obu.c b/av1/decoder/obu.c
index cf03ff1..44ecf81 100644
--- a/av1/decoder/obu.c
+++ b/av1/decoder/obu.c
@@ -741,15 +741,6 @@
           assert(rb.bit_offset == 0);
           rb.bit_offset = 8 * frame_header_size;
         }
-        if (pbi->sequence_header_changed) {
-          if (pbi->common.frame_type == KEY_FRAME) {
-            // This is the start of a new coded video sequence.
-            pbi->sequence_header_changed = 0;
-          } else {
-            cm->error.error_code = AOM_CODEC_UNSUP_BITSTREAM;
-            return -1;
-          }
-        }
 
         decoded_payload_size = frame_header_size;
         pbi->frame_header_size = frame_header_size;