603735 - for loop in vp8_decode is dead code while vp8_mem_req_segs only has one alg

Status: NEW

(Core :: Audio/Video: Playback, defect, P3)

Description

[timeless]

#define NELEMENTS(x) (sizeof(x)/sizeof(x[0]))

57 static const mem_req_t vp8_mem_req_segs[] =
58 {
59     {VP8_SEG_ALG_PRIV,    0, 8, VPX_CODEC_MEM_ZERO, vp8_priv_sz},

this is "clearly" an end marker and not a real thing:
60     {VP8_SEG_MAX, 0, 0, 0, NULL}
61 };

there are 2 "elements" here, so NELEMENTS(vp8_mem_req_segs) = 2

63 struct vpx_codec_alg_priv
64 {
65     vpx_codec_priv_t        base;
66     vpx_codec_mmap_t        mmaps[NELEMENTS(vp8_mem_req_segs)-1];

here we use 2 - 1 == 1

67     vpx_codec_dec_cfg_t     cfg;
68     vp8_stream_info_t   si;
69     int                     defer_alloc;
70     int                     decoder_init;
71     VP8D_PTR                pbi;
72     int                     postproc_cfg_set;
73     vp8_postproc_cfg_t      postproc_cfg;
74     vpx_image_t             img;
75     int                     img_setup;
76     int                     img_avail;
77 };


324 static vpx_codec_err_t vp8_decode(vpx_codec_alg_priv_t  *ctx,
325                                   const uint8_t         *data,
326                                   unsigned int            data_sz,
327                                   void                    *user_priv,
328                                   long                    deadline)
329 {
330     vpx_codec_err_t res = VPX_CODEC_OK;
331 
332     ctx->img_avail = 0;
333 
334     /* Determine the stream parameters */
335     if (!ctx->si.h)
336         res = ctx->base.iface->dec.peek_si(data, data_sz, &ctx->si);
337 
338 
339     /* Perform deferred allocations, if required */
340     if (!res && ctx->defer_alloc)
341     {
342         int i;

here i = 1; and the declaration for ctx->mmaps was ctx->mmaps[1] from above,
thus 1 < 1 as a loop control. Which is false.
344         for (i = 1; !res && i < NELEMENTS(ctx->mmaps); i++)
345         {
346             vpx_codec_dec_cfg_t cfg;
347 
348             cfg.w = ctx->si.w;
349             cfg.h = ctx->si.h;
350             ctx->mmaps[i].id = vp8_mem_req_segs[i].id;
351             ctx->mmaps[i].sz = vp8_mem_req_segs[i].sz;
352             ctx->mmaps[i].align = vp8_mem_req_segs[i].align;
353             ctx->mmaps[i].flags = vp8_mem_req_segs[i].flags;
354 
355             if (!ctx->mmaps[i].sz)
356                 ctx->mmaps[i].sz = vp8_mem_req_segs[i].calc_sz(&cfg,
357                                    ctx->base.init_flags);
358 
359             res = vp8_mmap_alloc(&ctx->mmaps[i]);
360         }

It's /possible/ that the code actually wants to start at i = 0; Dunno