fix access to non-existent reference picture (#429)

strukturag · Nov 20, 2023 · bf7f0f4 · bf7f0f4
1 parent e36b4a1
commit bf7f0f4
Showing 1 changed file with 12 additions and 1 deletion.
diff --git a/libde265/motion.cc b/libde265/motion.cc
@@ -1717,8 +1717,15 @@ void derive_spatial_luma_vector_prediction(base_context* ctx,
 
       const de265_image* imgX = NULL;
       if (vi.predFlag[X]) imgX = ctx->get_image(shdr->RefPicList[X][ vi.refIdx[X] ]);
+
       const de265_image* imgY = NULL;
-      if (vi.predFlag[Y]) imgY = ctx->get_image(shdr->RefPicList[Y][ vi.refIdx[Y] ]);
+      if (vi.predFlag[Y]) {
+        // check for input data validity
+        if (vi.refIdx[Y]<0 || vi.refIdx[Y] >= MAX_NUM_REF_PICS)
+          return;
+
+        imgY = ctx->get_image(shdr->RefPicList[Y][ vi.refIdx[Y] ]);
+      }
 
       // check whether the predictor X is available and references the same POC
       if (vi.predFlag[X] && imgX && imgX->PicOrderCntVal == referenced_POC) {
@@ -1848,6 +1855,10 @@ void derive_spatial_luma_vector_prediction(base_context* ctx,
       logtrace(LogMotion,"MVP B%d=\n",k);
       logmvcand(vi);
 
+      if (vi.refIdx[Y] < 0 || vi.refIdx[Y] >= MAX_NUM_REF_PICS) {
+        return;
+      }
+
       const de265_image* imgX = NULL;
       if (vi.predFlag[X]) imgX = ctx->get_image(shdr->RefPicList[X][ vi.refIdx[X] ]);
       const de265_image* imgY = NULL;