Don't check size limit in aom_realloc_frame_buffer DECODE_WIDTH_LIMIT and DECODE_HEIGHT_LIMIT (used when CONFIG_SIZE_LIMIT is defined as 1) are intended for the decoder only. Since aom_realloc_frame_buffer() is shared by the decoder and the encoder, it should not check DECODE_WIDTH_LIMIT and DECODE_HEIGHT_LIMIT. Move the check to the aom_realloc_frame_buffer() call in the read_uncompressed_header() function. Bug: 385367183 Change-Id: Icdb3660e3631fefb690ef9f28a4d782e4c9a939d
diff --git a/aom_scale/generic/yv12config.c b/aom_scale/generic/yv12config.c index 77b016e..f282536 100644 --- a/aom_scale/generic/yv12config.c +++ b/aom_scale/generic/yv12config.c
@@ -239,11 +239,6 @@ aom_codec_frame_buffer_t *fb, aom_get_frame_buffer_cb_fn_t cb, void *cb_priv, bool alloc_pyramid, int alloc_y_plane_only) { -#if CONFIG_SIZE_LIMIT - if (width > DECODE_WIDTH_LIMIT || height > DECODE_HEIGHT_LIMIT) - return AOM_CODEC_MEM_ERROR; -#endif - if (ybf) { int y_stride = 0; int uv_stride = 0;
diff --git a/av1/decoder/decodeframe.c b/av1/decoder/decodeframe.c index 7d84953..cbf5e91 100644 --- a/av1/decoder/decodeframe.c +++ b/av1/decoder/decodeframe.c
@@ -4796,6 +4796,18 @@ } buf = &frame_bufs[buf_idx]; lock_buffer_pool(pool); +#if CONFIG_SIZE_LIMIT + if (seq_params->max_frame_width > DECODE_WIDTH_LIMIT || + seq_params->max_frame_height > DECODE_HEIGHT_LIMIT) { + decrease_ref_count(buf, pool); + unlock_buffer_pool(pool); + aom_internal_error( + cm->error, AOM_CODEC_CORRUPT_FRAME, + "Dimensions of %dx%d beyond allowed size of %dx%d.", + seq_params->max_frame_width, seq_params->max_frame_height, + DECODE_WIDTH_LIMIT, DECODE_HEIGHT_LIMIT); + } +#endif if (aom_realloc_frame_buffer( &buf->buf, seq_params->max_frame_width, seq_params->max_frame_height, seq_params->subsampling_x,