Validate the length of `num_ref_pics` with `kMaxVp9RefPics` instead of
`EncodedFrame::kMaxFrameReferences`.

Bug: chromium:454367825
Change-Id: Id99046a0e573875aa6d33e6b869fba536a1ac5da
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/475820
Commit-Queue: Philip Eliasson <philipel@webrtc.org>
Reviewed-by: Erik Språng <sprang@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#47808}

modules/video_coding/rtp_vp9_ref_finder.cc

diff --git a/modules/video_coding/rtp_vp9_ref_finder.cc b/modules/video_coding/rtp_vp9_ref_finder.cc
index 5ee19a9..4f5969a 100644
--- a/modules/video_coding/rtp_vp9_ref_finder.cc
+++ b/modules/video_coding/rtp_vp9_ref_finder.cc
@@ -85,7 +85,7 @@
 RtpVp9RefFinder::FrameDecision RtpVp9RefFinder::ManageFrameFlexible(
     RtpFrameObject* frame,
     const RTPVideoHeaderVP9& codec_header) {
-  if (codec_header.num_ref_pics > EncodedFrame::kMaxFrameReferences) {
+  if (codec_header.num_ref_pics > kMaxVp9RefPics) {
     return kDrop;
   }
 
@@ -200,7 +200,7 @@
                                                         frame->Id());
     size_t gof_idx = diff % info->gof->num_frames_in_gof;
 
-    if (info->gof->num_ref_pics[gof_idx] > EncodedFrame::kMaxFrameReferences) {
+    if (info->gof->num_ref_pics[gof_idx] > kMaxVp9RefPics) {
       return kDrop;
     }
 

modules/video_coding/rtp_vp9_ref_finder_unittest.cc

diff --git a/modules/video_coding/rtp_vp9_ref_finder_unittest.cc b/modules/video_coding/rtp_vp9_ref_finder_unittest.cc
index 7ca4e03..0ca1a3b 100644
--- a/modules/video_coding/rtp_vp9_ref_finder_unittest.cc
+++ b/modules/video_coding/rtp_vp9_ref_finder_unittest.cc
@@ -115,7 +115,7 @@
     } else {
       vp9_header.flexible_mode = true;
       vp9_header.num_ref_pics = flex_refs.size();
-      for (size_t i = 0; i < flex_refs.size(); ++i) {
+      for (size_t i = 0; i < std::min(flex_refs.size(), kMaxVp9RefPics); ++i) {
         vp9_header.pid_diff[i] = flex_refs.at(i);
       }
     }
@@ -693,4 +693,27 @@
   EXPECT_THAT(frames_, SizeIs(0));
 }
 
+TEST_F(RtpVp9RefFinderTest, FlexibleModeTooManyReferencesDropsFrame) {
+  Insert(Frame().Pid(0).SidAndTid(0, 0).AsKeyFrame());
+  EXPECT_THAT(frames_, SizeIs(1));
+  Insert(Frame().Pid(1).SidAndTid(0, 0).FlexRefs({1, 2, 3, 4}));
+  EXPECT_THAT(frames_, SizeIs(1));
+}
+
+TEST_F(RtpVp9RefFinderTest, GofTooManyReferencesDropsFrame) {
+  GofInfoVP9 ss;
+  ss.num_frames_in_gof = 2;
+  ss.temporal_idx[0] = 0;
+  ss.num_ref_pics[0] = 1;
+  ss.pid_diff[0][0] = 1;
+
+  // GOF index 1 requires 4 reference pictures (more than kMaxVp9RefPics = 3).
+  ss.temporal_idx[1] = 1;
+  ss.num_ref_pics[1] = 4;
+  ss.pid_diff[1][0] = 1;
+
+  Insert(Frame().Pid(0).SidAndTid(0, 0).Tl0(0).AsKeyFrame().Gof(&ss));
+  EXPECT_THAT(frames_, SizeIs(0));
+}
+
 }  // namespace webrtc