diff options
author | Naveen Kumar P <naveenkumar.p@ittiam.com> | 2017-05-25 15:30:59 +0530 |
---|---|---|
committer | Ivan Kutepov <its.kutepov@gmail.com> | 2017-08-13 19:56:34 +0300 |
commit | 2907089d17d4098aba2b0bbedf982541f51ba1d3 (patch) | |
tree | 584d7fbd53b3df76135c27128d76855d6368a96a | |
parent | a977d10880c26dda1e46ac6297cac845094ee163 (diff) | |
download | android_external_libhevc-2907089d17d4098aba2b0bbedf982541f51ba1d3.tar.gz android_external_libhevc-2907089d17d4098aba2b0bbedf982541f51ba1d3.tar.bz2 android_external_libhevc-2907089d17d4098aba2b0bbedf982541f51ba1d3.zip |
Fix OOB issue in nal unit parsingreplicant-6.0-0002
Bug: 37712181
Test: ran patched against POC on nyc-mr2
Change-Id: I5408b3afd898db99265f94573d1163ef83c9b99c
(cherry picked from commit 62ebc3276199bef53c4b87cfcd8c8586af255fee)
-rw-r--r-- | decoder/ihevcd_nal.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/decoder/ihevcd_nal.c b/decoder/ihevcd_nal.c index bee399f..cc4a27f 100644 --- a/decoder/ihevcd_nal.c +++ b/decoder/ihevcd_nal.c @@ -114,7 +114,8 @@ WORD32 ihevcd_nal_search_start_code(UWORD8 *pu1_buf, WORD32 bytes_remaining) } zero_byte_cnt++; - if((pu1_buf[ofst + 1] == START_CODE_PREFIX_BYTE) && + if((ofst < (bytes_remaining - 1)) && + (pu1_buf[ofst + 1] == START_CODE_PREFIX_BYTE) && (zero_byte_cnt >= NUM_ZEROS_BEFORE_START_CODE)) { /* Found the start code */ @@ -123,7 +124,7 @@ WORD32 ihevcd_nal_search_start_code(UWORD8 *pu1_buf, WORD32 bytes_remaining) break; } } - if(0 == start_code_found) + if((0 == start_code_found) && (ofst < bytes_remaining)) { if((START_CODE_PREFIX_BYTE == pu1_buf[ofst]) && (zero_byte_cnt >= NUM_ZEROS_BEFORE_START_CODE)) @@ -231,7 +232,7 @@ IHEVCD_ERROR_T ihevcd_nal_remv_emuln_bytes(UWORD8 *pu1_src, } - if(0 == start_code_found) + if((0 == start_code_found) && (src_cnt < bytes_remaining)) { u1_src = pu1_src[src_cnt++]; if(zero_byte_cnt >= NUM_ZEROS_BEFORE_START_CODE) |