diff options
| author | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | 2017-01-05 13:48:55 +0530 |
|---|---|---|
| committer | Sean McCreary <mccreary@mcwest.org> | 2017-04-05 19:16:28 -0600 |
| commit | 36a82ac79d2409bb629a6482758bf4fd00906439 (patch) | |
| tree | 53541ce552d68cfabe6e63c5cb495d9d7627a371 | |
| parent | 85820c2befe6d5814f2bcf51ddef3e02a5442c3d (diff) | |
| download | android_external_libavc-36a82ac79d2409bb629a6482758bf4fd00906439.tar.gz android_external_libavc-36a82ac79d2409bb629a6482758bf4fd00906439.tar.bz2 android_external_libavc-36a82ac79d2409bb629a6482758bf4fd00906439.zip | |
Decoder: Return correct error code for slice header errors
Return ERROR_INV_SLICE_HDR_T instead of ERROR_INV_SPS_PPS_T for slice
header errors.
Bug: 34097915
AOSP-Change-Id: I45d14a71f2322ff349058baaf65fb0f3c1140fba
CVE-2017-0552
Change-Id: I4c87503f9014f67721fb3a06a7542215d4f10cd6
(cherry picked from commit 9a00f562a612d56e7b2b989d168647db900ba6cf)
| -rw-r--r-- | decoder/ih264d_parse_pslice.c | 2 | ||||
| -rw-r--r-- | decoder/ih264d_parse_slice.c | 14 |
2 files changed, 8 insertions, 8 deletions
diff --git a/decoder/ih264d_parse_pslice.c b/decoder/ih264d_parse_pslice.c index 5e30b42..171ed16 100644 --- a/decoder/ih264d_parse_pslice.c +++ b/decoder/ih264d_parse_pslice.c @@ -1504,7 +1504,7 @@ WORD32 ih264d_mark_err_slice_skip(dec_struct_t * ps_dec, //if valid SPS PPS is not found return error if(j == -1) { - return ERROR_INV_SPS_PPS_T; + return ERROR_INV_SLICE_HDR_T; } /* call ih264d_start_of_pic only if it was not called earlier*/ diff --git a/decoder/ih264d_parse_slice.c b/decoder/ih264d_parse_slice.c index 16c2f70..9b0084e 100644 --- a/decoder/ih264d_parse_slice.c +++ b/decoder/ih264d_parse_slice.c @@ -1101,19 +1101,19 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice, u4_temp = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf); if(u4_temp & MASK_ERR_PIC_SET_ID) - return ERROR_INV_SPS_PPS_T; + return ERROR_INV_SLICE_HDR_T; /* discard slice if pic param is invalid */ COPYTHECONTEXT("SH: pic_parameter_set_id", u4_temp); ps_pps = &ps_dec->ps_pps[u4_temp]; if(FALSE == ps_pps->u1_is_valid) { - return ERROR_INV_SPS_PPS_T; + return ERROR_INV_SLICE_HDR_T; } ps_seq = ps_pps->ps_sps; if(!ps_seq) - return ERROR_INV_SPS_PPS_T; + return ERROR_INV_SLICE_HDR_T; if(FALSE == ps_seq->u1_is_valid) - return ERROR_INV_SPS_PPS_T; + return ERROR_INV_SLICE_HDR_T; /* Get the frame num */ u2_frame_num = ih264d_get_bits_h264(ps_bitstrm, @@ -1198,7 +1198,7 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice, u4_idr_pic_id = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf); if(u4_idr_pic_id > 65535) - return ERROR_INV_SPS_PPS_T; + return ERROR_INV_SLICE_HDR_T; COPYTHECONTEXT("SH: ", u4_idr_pic_id); } @@ -1213,7 +1213,7 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice, ps_bitstrm, ps_seq->u1_log2_max_pic_order_cnt_lsb_minus); if(i_temp < 0 || i_temp >= ps_seq->i4_max_pic_order_cntLsb) - return ERROR_INV_SPS_PPS_T; + return ERROR_INV_SLICE_HDR_T; s_tmp_poc.i4_pic_order_cnt_lsb = i_temp; COPYTHECONTEXT("SH: pic_order_cnt_lsb", s_tmp_poc.i4_pic_order_cnt_lsb); @@ -1250,7 +1250,7 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice, { u4_temp = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf); if(u4_temp > MAX_REDUNDANT_PIC_CNT) - return ERROR_INV_SPS_PPS_T; + return ERROR_INV_SLICE_HDR_T; u1_redundant_pic_cnt = u4_temp; COPYTHECONTEXT("SH: redundant_pic_cnt", u1_redundant_pic_cnt); } |