diff options
| author | Naveen Kumar P <naveenkumar.p@ittiam.com> | 2017-10-12 15:28:20 +0530 |
|---|---|---|
| committer | MSe <mse1969@posteo.de> | 2018-01-10 20:56:52 +0100 |
| commit | 7c8fcb60438503df9e7468f7661be7e52ed5523d (patch) | |
| tree | 3d630a2ef8cf315eedd7894091d07de9bf61676c | |
| parent | ec9652004ed7c4c823e0a02319a355015c6c8c21 (diff) | |
| download | android_external_libhevc-7c8fcb60438503df9e7468f7661be7e52ed5523d.tar.gz android_external_libhevc-7c8fcb60438503df9e7468f7661be7e52ed5523d.tar.bz2 android_external_libhevc-7c8fcb60438503df9e7468f7661be7e52ed5523d.zip | |
Return error for negative crop parameters
Bug: 65398821
Change-Id: I18a94d40d77504bb9c9d5a5e7bf41207aed28712
Signed-off-by: Sungtak Lee <taklee@google.com>
(cherry picked from commit 978d3320ef3dc60f69f8c4ba215b869d11b03944)
CVE-2017-13195
| -rw-r--r-- | decoder/ihevcd_parse_headers.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c index 06f5ef1..c62fda9 100644 --- a/decoder/ihevcd_parse_headers.c +++ b/decoder/ihevcd_parse_headers.c @@ -1283,28 +1283,28 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) { UEV_PARSE("pic_crop_left_offset", value, ps_bitstrm); - if (value >= ps_sps->i2_pic_width_in_luma_samples) + if (value < 0 || value >= ps_sps->i2_pic_width_in_luma_samples) { return IHEVCD_INVALID_PARAMETER; } ps_sps->i2_pic_crop_left_offset = value; UEV_PARSE("pic_crop_right_offset", value, ps_bitstrm); - if (value >= ps_sps->i2_pic_width_in_luma_samples) + if (value < 0 || value >= ps_sps->i2_pic_width_in_luma_samples) { return IHEVCD_INVALID_PARAMETER; } ps_sps->i2_pic_crop_right_offset = value; UEV_PARSE("pic_crop_top_offset", value, ps_bitstrm); - if (value >= ps_sps->i2_pic_height_in_luma_samples) + if (value < 0 || value >= ps_sps->i2_pic_height_in_luma_samples) { return IHEVCD_INVALID_PARAMETER; } ps_sps->i2_pic_crop_top_offset = value; UEV_PARSE("pic_crop_bottom_offset", value, ps_bitstrm); - if (value >= ps_sps->i2_pic_height_in_luma_samples) + if (value < 0 || value >= ps_sps->i2_pic_height_in_luma_samples) { return IHEVCD_INVALID_PARAMETER; } |