diff options
| author | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | 2016-12-15 18:04:53 +0530 |
|---|---|---|
| committer | Sean McCreary <mccreary@mcwest.org> | 2017-04-05 19:13:25 -0600 |
| commit | 85820c2befe6d5814f2bcf51ddef3e02a5442c3d (patch) | |
| tree | e43b665a4bea2e806d4db3958a2ef4112d0f6a74 | |
| parent | 7d6baad45c33caea663643f1912907903bbb3595 (diff) | |
| download | android_external_libavc-85820c2befe6d5814f2bcf51ddef3e02a5442c3d.tar.gz android_external_libavc-85820c2befe6d5814f2bcf51ddef3e02a5442c3d.tar.bz2 android_external_libavc-85820c2befe6d5814f2bcf51ddef3e02a5442c3d.zip | |
Fix in returning end of bitstream error for MBAFF
In case of MBAFF streams, slices should terminate on
even MB boundary. If bytes are exhausted with odd number
of MBs decoded for MBAff, then treat that as error.
Bug: 33933140
AOSP-Change-Id: Ifc26b66ff8ebdb3aec5c0d6c512e4cac3f54c5b7
CVE-2017-0550
Change-Id: I239352c34311d40096ebd7eed66acfb11a628475
(cherry picked from commit 7950bf47b6944546a0aff11a7184947de9591b51)
| -rw-r--r-- | decoder/ih264d_parse_islice.c | 4 | ||||
| -rw-r--r-- | decoder/ih264d_parse_pslice.c | 4 |
2 files changed, 8 insertions, 0 deletions
diff --git a/decoder/ih264d_parse_islice.c b/decoder/ih264d_parse_islice.c index a5072e9..0312060 100644 --- a/decoder/ih264d_parse_islice.c +++ b/decoder/ih264d_parse_islice.c @@ -869,6 +869,10 @@ WORD32 ih264d_parse_islice_data_cavlc(dec_struct_t * ps_dec, if(u1_mbaff) { ih264d_update_mbaff_left_nnz(ps_dec, ps_cur_mb_info); + if(!uc_more_data_flag && (0 == (i2_cur_mb_addr & 1))) + { + return ERROR_EOB_FLUSHBITS_T; + } } /**************************************************************/ /* Get next Macroblock address */ diff --git a/decoder/ih264d_parse_pslice.c b/decoder/ih264d_parse_pslice.c index 0042ff2..5e30b42 100644 --- a/decoder/ih264d_parse_pslice.c +++ b/decoder/ih264d_parse_pslice.c @@ -1348,6 +1348,10 @@ WORD32 ih264d_parse_inter_slice_data_cavlc(dec_struct_t * ps_dec, if(u1_mbaff) { ih264d_update_mbaff_left_nnz(ps_dec, ps_cur_mb_info); + if(!uc_more_data_flag && !i2_mb_skip_run && (0 == (i2_cur_mb_addr & 1))) + { + return ERROR_EOB_FLUSHBITS_T; + } } /**************************************************************/ /* Get next Macroblock address */ |