commit bdfb4a6fbd0be4367ed23147dbe20f9c39e7a27e
author Rupert Swarbrick <rupert.swarbrick@argondesign.com> Thu Sep 07 14:26:25 2017 +0100
committer Rupert Swarbrick <rupert.swarbrick@argondesign.com> Wed Sep 13 08:49:40 2017 +0000
tree ef04d1d1028064b8995d4522c209cef716a1ed08
parent 0f248c464a5dd015596bb79357af53ef9ee81ec1

Report a proper error when bitstream wrongly requests prev_frame_mvs

Using an assert (which was compiled out) meant we got to a
use-after-free in bug 729.

BUG=aomedia:729

Change-Id: I4d0fa5e80322c395f94565c76e2285782c328505

av1/decoder/decodeframe.c

diff --git a/av1/decoder/decodeframe.c b/av1/decoder/decodeframe.c
index 8db78b9..1e67971 100644
--- a/av1/decoder/decodeframe.c
+++ b/av1/decoder/decodeframe.c
@@ -5243,7 +5243,10 @@
 #endif  // CONFIG_EXT_REFS || CONFIG_TEMPMV_SIGNALING
 
 #if CONFIG_TEMPMV_SIGNALING
-  if (cm->use_prev_frame_mvs) assert(frame_can_use_prev_frame_mvs(cm));
+  if (cm->use_prev_frame_mvs && !frame_can_use_prev_frame_mvs(cm)) {
+    aom_internal_error(&cm->error, AOM_CODEC_CORRUPT_FRAME,
+                       "Frame wrongly requests previous frame MVs");
+  }
 #else
   cm->use_prev_frame_mvs = !cm->error_resilient_mode && cm->prev_frame &&
 #if CONFIG_FRAME_SUPERRES