summaryrefslogtreecommitdiffstats
path: root/decoder
diff options
context:
space:
mode:
authorHarish Mahendrakar <harish.mahendrakar@ittiam.com>2017-06-16 15:37:48 +0530
committerIvan Kutepov <its.kutepov@gmail.com>2017-11-11 17:59:06 +0300
commitca208d1da7b63b6b922580031b7cb959df910d0c (patch)
tree8c095b93277932d9c0a1ee552918ce581ec39e8a /decoder
parent7d6419fa962781738217b02054b4efb09fff9559 (diff)
downloadandroid_external_libavc-ca208d1da7b63b6b922580031b7cb959df910d0c.tar.gz
android_external_libavc-ca208d1da7b63b6b922580031b7cb959df910d0c.tar.bz2
android_external_libavc-ca208d1da7b63b6b922580031b7cb959df910d0c.zip
Added an out of bound check on u4_num_bufs in input argument
ps_dec_ip->s_out_buffer.u4_num_bufs was missing out of bound checks Bug: 62688399 Change-Id: Ic5e5c002d29fcb18064550d5a5f9289bb68b448e CVE-2017-0849
Diffstat (limited to 'decoder')
-rw-r--r--decoder/ih264d_api.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index b34b6f5..f4d641f 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -1771,7 +1771,8 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op)
&& ps_dec->i4_decode_header == 0)
{
UWORD32 i;
- if(ps_dec->ps_out_buffer->u4_num_bufs == 0)
+ if((ps_dec->ps_out_buffer->u4_num_bufs == 0) ||
+ (ps_dec->ps_out_buffer->u4_num_bufs > IVD_VIDDEC_MAX_IO_BUFFERS))
{
ps_dec_op->u4_error_code |= 1 << IVD_UNSUPPORTEDPARAM;
ps_dec_op->u4_error_code |= IVD_DISP_FRM_ZERO_OP_BUFS;