commit d31a6007d8741870ea8f79a2afb1a7064bf65d04
author Hui Su <huisu@google.com> Mon Jul 09 14:44:35 2018 -0700
committer Hui Su <huisu@google.com> Wed Jul 11 17:34:47 2018 +0000
tree 1e74f3d5f9597b14496f4a1c1e90cb4e46ccd6a7
parent 12d9ad871df523bf6ee01c14261e8dbb3366a539

Avoid incomplete seq header decoding

Only update sequence header info. upon complete successful decoding.

BUG=oss-fuzz:9321

Change-Id: Iadf61a600ec5b8338fabc573b4b1aa65ceac4b1d

av1/decoder/decodeframe.c

diff --git a/av1/decoder/decodeframe.c b/av1/decoder/decodeframe.c
index e16431c..b4e5bfc 100644
--- a/av1/decoder/decodeframe.c
+++ b/av1/decoder/decodeframe.c
@@ -3745,13 +3745,13 @@
 }
 
 void av1_read_color_config(AV1_COMMON *cm, struct aom_read_bit_buffer *rb,
-                           int allow_lowbitdepth) {
+                           int allow_lowbitdepth, SequenceHeader *seq_params) {
   av1_read_bitdepth(cm, rb);
 
   cm->use_highbitdepth = cm->bit_depth > AOM_BITS_8 || !allow_lowbitdepth;
   // monochrome bit (not needed for PROFILE_1)
   const int is_monochrome = cm->profile != PROFILE_1 ? aom_rb_read_bit(rb) : 0;
-  cm->seq_params.monochrome = is_monochrome;
+  seq_params->monochrome = is_monochrome;
   int color_description_present_flag = aom_rb_read_bit(rb);
   if (color_description_present_flag) {
     cm->color_primaries = aom_rb_read_literal(rb, 8);
@@ -3879,17 +3879,12 @@
       rb, cm->buffer_model.frame_presentation_time_length);
 }
 
-void read_sequence_header(AV1_COMMON *cm, struct aom_read_bit_buffer *rb) {
-  // rb->error_handler may be triggered during aom_rb_read_bit(), raising
-  // internal errors and immediate decoding termination. We use a local variable
-  // to store the info. as we decode. At the end, if no errors have occurred,
-  // cm->seq_params is updated.
-  SequenceHeader sh = cm->seq_params;
-  SequenceHeader *const seq_params = &sh;
-  int num_bits_width = aom_rb_read_literal(rb, 4) + 1;
-  int num_bits_height = aom_rb_read_literal(rb, 4) + 1;
-  int max_frame_width = aom_rb_read_literal(rb, num_bits_width) + 1;
-  int max_frame_height = aom_rb_read_literal(rb, num_bits_height) + 1;
+void av1_read_sequence_header(AV1_COMMON *cm, struct aom_read_bit_buffer *rb,
+                              SequenceHeader *seq_params) {
+  const int num_bits_width = aom_rb_read_literal(rb, 4) + 1;
+  const int num_bits_height = aom_rb_read_literal(rb, 4) + 1;
+  const int max_frame_width = aom_rb_read_literal(rb, num_bits_width) + 1;
+  const int max_frame_height = aom_rb_read_literal(rb, num_bits_height) + 1;
 
   seq_params->num_bits_width = num_bits_width;
   seq_params->num_bits_height = num_bits_height;
@@ -3964,7 +3959,6 @@
   seq_params->enable_superres = aom_rb_read_bit(rb);
   seq_params->enable_cdef = aom_rb_read_bit(rb);
   seq_params->enable_restoration = aom_rb_read_bit(rb);
-  cm->seq_params = *seq_params;
 }
 
 static int read_global_motion_params(WarpedMotionParams *params,