From 52add5896661d186dec284ed646a4b33b607d2c7 Mon Sep 17 00:00:00 2001
From: Jerome Jiang <jianj@google.com>
Date: Wed, 23 May 2018 15:43:00 -0700
Subject: [PATCH] VP8: Fix use-after-free in postproc.

The pointer in vp8 postproc refers to show_frame_mi which is only
updated on show frame. However, when there is a no-show frame which also
changes the size (thus new frame buffers allocated), show_frame_mi is
not updated with new frame buffer memory.

Change the pointer in postproc to mi which is always updated.

Bug: 842265
Change-Id: I33874f2112b39f74562cba528432b5f239e6a7bd
---
 vp8/common/postproc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/vp8/common/postproc.c b/vp8/common/postproc.c
index d67ee8a57..8c292d616 100644
--- a/vp8/common/postproc.c
+++ b/vp8/common/postproc.c
@@ -65,7 +65,7 @@ void vp8_deblock(VP8_COMMON *cm, YV12_BUFFER_CONFIG *source,
   double level = 6.0e-05 * q * q * q - .0067 * q * q + .306 * q + .0065;
   int ppl = (int)(level + .5);
 
-  const MODE_INFO *mode_info_context = cm->show_frame_mi;
+  const MODE_INFO *mode_info_context = cm->mi;
   int mbr, mbc;
 
   /* The pixel thresholds are adjusted according to if or not the macroblock
-- 
2.19.0

ee/gnu/tests/desktop.scm?id=948fb52b2cd88d0c79a91911d6b874747d1b957d'>tree</a><a href='/guix/commit/gnu/tests/desktop.scm?id=948fb52b2cd88d0c79a91911d6b874747d1b957d'>commit</a><a href='/guix/diff/gnu/tests/desktop.scm?id=948fb52b2cd88d0c79a91911d6b874747d1b957d'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/gnu/tests/desktop.scm'>
<input type='hidden' name='id' value='948fb52b2cd88d0c79a91911d6b874747d1b957d'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=948fb52b2cd88d0c79a91911d6b874747d1b957d'>root</a>/<a href='/guix/log/gnu?id=948fb52b2cd88d0c79a91911d6b874747d1b957d'>gnu</a>/<a href='/guix/log/gnu/tests?id=948fb52b2cd88d0c79a91911d6b874747d1b957d'>tests</a>/<a href='/guix/log/gnu/tests/desktop.scm?id=948fb52b2cd88d0c79a91911d6b874747d1b957d'>desktop.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/tests/desktop.scm?id=948fb52b2cd88d0c79a91911d6b874747d1b957d&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>