diff options
author | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | 2017-06-16 15:37:48 +0530 |
---|---|---|
committer | Ivan Kutepov <its.kutepov@gmail.com> | 2017-11-11 17:59:06 +0300 |
commit | ca208d1da7b63b6b922580031b7cb959df910d0c (patch) | |
tree | 8c095b93277932d9c0a1ee552918ce581ec39e8a /decoder | |
parent | 7d6419fa962781738217b02054b4efb09fff9559 (diff) | |
download | android_external_libavc-ca208d1da7b63b6b922580031b7cb959df910d0c.tar.gz android_external_libavc-ca208d1da7b63b6b922580031b7cb959df910d0c.tar.bz2 android_external_libavc-ca208d1da7b63b6b922580031b7cb959df910d0c.zip |
Added an out of bound check on u4_num_bufs in input argument
ps_dec_ip->s_out_buffer.u4_num_bufs was missing out of bound checks
Bug: 62688399
Change-Id: Ic5e5c002d29fcb18064550d5a5f9289bb68b448e
CVE-2017-0849
Diffstat (limited to 'decoder')
-rw-r--r-- | decoder/ih264d_api.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c index b34b6f5..f4d641f 100644 --- a/decoder/ih264d_api.c +++ b/decoder/ih264d_api.c @@ -1771,7 +1771,8 @@ WORD32 ih264d_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op) && ps_dec->i4_decode_header == 0) { UWORD32 i; - if(ps_dec->ps_out_buffer->u4_num_bufs == 0) + if((ps_dec->ps_out_buffer->u4_num_bufs == 0) || + (ps_dec->ps_out_buffer->u4_num_bufs > IVD_VIDDEC_MAX_IO_BUFFERS)) { ps_dec_op->u4_error_code |= 1 << IVD_UNSUPPORTEDPARAM; ps_dec_op->u4_error_code |= IVD_DISP_FRM_ZERO_OP_BUFS; |