commit 88ba08818efbfcc9a8a7fa3b998b33dfadc7b9fb
author Jim Bankoski <jimbankoski@google.com> Thu Jun 19 12:10:05 2014 -0700
committer Gerrit Code Review <gerrit@gerrit.golo.chromium.org> Fri Jun 20 14:44:50 2014 -0700
tree 38ddcbef35df623a12c5063a6ad270bea25b152c
parent edbd05ff10b7cf2db10e640a44c0bdaf15f32875

Fix bug in error handling that causes segfault

See: https://code.google.com/p/chromium/issues/detail?id=362697

The code properly catches an invalid stream but seg faults instead of
returning an error due to a buffer not having been initialized. This
code fixes that.

Change-Id: I695595e742cb08807e1dfb2f00bc097b3eae3a9b

test/invalid_file_test.cc

diff --git a/test/invalid_file_test.cc b/test/invalid_file_test.cc
index 4c04675..e7f2a48 100644
--- a/test/invalid_file_test.cc
+++ b/test/invalid_file_test.cc
@@ -64,7 +64,7 @@
   FILE *res_file_;
 };
 
-TEST_P(InvalidFileTest, DISABLED_ReturnCode) {
+TEST_P(InvalidFileTest, ReturnCode) {
   const std::string filename = GET_PARAM(1);
   libvpx_test::CompressedVideoSource *video = NULL;
 

vp9/decoder/vp9_decodeframe.c

diff --git a/vp9/decoder/vp9_decodeframe.c b/vp9/decoder/vp9_decodeframe.c
index fc70035..f36105f 100644
--- a/vp9/decoder/vp9_decodeframe.c
+++ b/vp9/decoder/vp9_decodeframe.c
@@ -1077,7 +1077,7 @@
     // Show an existing frame directly.
     const int frame_to_show = cm->ref_frame_map[vp9_rb_read_literal(rb, 3)];
 
-    if (cm->frame_bufs[frame_to_show].ref_count < 1)
+    if (frame_to_show < 0 || cm->frame_bufs[frame_to_show].ref_count < 1)
       vpx_internal_error(&cm->error, VPX_CODEC_UNSUP_BITSTREAM,
                          "Buffer %d does not contain a decoded frame",
                          frame_to_show);

vp9/decoder/vp9_decoder.c

diff --git a/vp9/decoder/vp9_decoder.c b/vp9/decoder/vp9_decoder.c
index 5859859..f610262 100644
--- a/vp9/decoder/vp9_decoder.c
+++ b/vp9/decoder/vp9_decoder.c
@@ -260,10 +260,10 @@
     // TODO(jkoleszar): Error concealment is undefined and non-normative
     // at this point, but if it becomes so, [0] may not always be the correct
     // thing to do here.
-    if (cm->frame_refs[0].idx != INT_MAX)
+    if (cm->frame_refs[0].idx != INT_MAX && cm->frame_refs[0].buf != NULL)
       cm->frame_refs[0].buf->corrupted = 1;
 
-    if (cm->frame_bufs[cm->new_fb_idx].ref_count > 0)
+    if (cm->new_fb_idx > 0 && cm->frame_bufs[cm->new_fb_idx].ref_count > 0)
       cm->frame_bufs[cm->new_fb_idx].ref_count--;
 
     return -1;