commit df0ec99b291c0aaa3881667cd15e2928145e9402
author Ritu Baldwa <ritu.baldwa@ittiam.com> Tue Nov 28 18:38:18 2017 +0530
committer android-build-team Robot <android-build-team-robot@google.com> Fri Dec 15 00:46:23 2017 +0000
tree b1c4c17580d50318b67c965d934577d2b3badfd5
parent 8d8e1eb75c13caa3c2c3ae3f032f5d0305ed302e

Decoder: Modified loop condition while parsing ref_list_reordering.

When ref_pic_list_reordering_flag_l1 is equal to 1, the number of times
that reordering_of_pic_nums_idc is not equal to 3 following
ref_pic_list_reordering_flag_l1 should not exceed
num_ref_idx_l1_active_minus1 + 1.

Bug: 69478425
Change-Id: I031bb744869ac8a57f85bb97574832efd0eefc25
(cherry picked from commit 7ea47d575d26d4d5356670092af26fb6915e75bf)

decoder/ih264d_dpb_mgr.c

diff --git a/decoder/ih264d_dpb_mgr.c b/decoder/ih264d_dpb_mgr.c
index f6417c7..525adef 100644
--- a/decoder/ih264d_dpb_mgr.c
+++ b/decoder/ih264d_dpb_mgr.c
@@ -722,7 +722,7 @@
     UWORD16 ui_max_frame_num =
                     ps_dec->ps_cur_sps->u2_u4_max_pic_num_minus1 + 1;
 
-    WORD32 i;
+    WORD32 i, count = 0;
     UWORD32 ui_remapIdc, ui_nextUev;
     WORD16 u2_pred_frame_num = u4_cur_pic_num;
     WORD32 i_temp;
@@ -743,7 +743,8 @@
 
     ui_remapIdc = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
 
-    while(ui_remapIdc != 3)
+    while((ui_remapIdc != 3)
+                    && (count < ps_cur_slice->u1_num_ref_idx_lx_active[uc_lx]))
     {
         ui_nextUev = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
         if(ui_remapIdc != 2)
@@ -812,6 +813,7 @@
 
         ui_remapIdc = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
         /* Get the remapping_idc - 0/1/2/3 */
+        count++;
     }
 
     //Handle the ref indices that were not remapped