VP9 temporal index bounds check.
Bug: chromium:838672
Change-Id: Ia531327858b6e40cb7fa03ca1b98c120ba4e1389
Reviewed-on: https://webrtc-review.googlesource.com/73701
Reviewed-by: Stefan Holmer <stefan@webrtc.org>
Commit-Queue: Philip Eliasson <philipel@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#23099}diff --git a/modules/video_coding/rtp_frame_reference_finder.cc b/modules/video_coding/rtp_frame_reference_finder.cc
index be05e56..09b2593 100644
--- a/modules/video_coding/rtp_frame_reference_finder.cc
+++ b/modules/video_coding/rtp_frame_reference_finder.cc
@@ -533,6 +533,12 @@
size_t gof_idx = diff % info.gof->num_frames_in_gof;
size_t temporal_idx = info.gof->temporal_idx[gof_idx];
+ if (temporal_idx >= kMaxTemporalLayers) {
+ RTC_LOG(LS_WARNING) << "At most " << kMaxTemporalLayers << " temporal "
+ << "layers are supported.";
+ return true;
+ }
+
// For every reference this frame has, check if there is a frame missing in
// the interval (|ref_pid|, |picture_id|) in any of the lower temporal
// layers. If so, we are missing a required frame.
diff --git a/modules/video_coding/rtp_frame_reference_finder_unittest.cc b/modules/video_coding/rtp_frame_reference_finder_unittest.cc
index 7819514..dd9b2de 100644
--- a/modules/video_coding/rtp_frame_reference_finder_unittest.cc
+++ b/modules/video_coding/rtp_frame_reference_finder_unittest.cc
@@ -1331,5 +1331,21 @@
InsertVp9Gof(sn + 1, sn + 1, false, pid + 1000, 0, 0, 1);
}
+TEST_F(TestRtpFrameReferenceFinder, Vp9GofTidTooHigh) {
+ // Same as RtpFrameReferenceFinder::kMaxTemporalLayers.
+ const int kMaxTemporalLayers = 5;
+ uint16_t pid = Rand();
+ uint16_t sn = Rand();
+ GofInfoVP9 ss;
+ ss.SetGofInfoVP9(kTemporalStructureMode2);
+ ss.temporal_idx[1] = kMaxTemporalLayers;
+
+ InsertVp9Gof(sn, sn, true, pid, 0, 0, 0, false, &ss);
+ InsertVp9Gof(sn + 1, sn + 1, false, pid + 1, 0, 0, 1);
+
+ ASSERT_EQ(1UL, frames_from_callback_.size());
+ CheckReferencesVp9(0, 0);
+}
+
} // namespace video_coding
} // namespace webrtc
