diff options
| author | Naveen Kumar P <naveenkumar.p@ittiam.com> | 2017-07-10 18:08:04 +0530 |
|---|---|---|
| committer | MSe <mse1969@posteo.de> | 2018-01-10 20:56:50 +0100 |
| commit | 89ec98a0746f5ddc73ebaa7c4ccc2e0f0eb40a7d (patch) | |
| tree | 550a0548d095edffc06a6029e1f810ae053f9f3f | |
| parent | b99b81c747d81834386d0cdcb01b719dfe6c7f67 (diff) | |
| download | android_external_libhevc-89ec98a0746f5ddc73ebaa7c4ccc2e0f0eb40a7d.tar.gz android_external_libhevc-89ec98a0746f5ddc73ebaa7c4ccc2e0f0eb40a7d.tar.bz2 android_external_libhevc-89ec98a0746f5ddc73ebaa7c4ccc2e0f0eb40a7d.zip | |
Fix slice address zero for not first slice in pic
The parameter slice address is parsed only slices that are not
first slice in the pic and the value cannot be zero.
Bug: 64380202
Test: ran PoC on master
Change-Id: Ic21c40cf67c916806113d2425790a27cb658b5d2
(cherry picked from commit ed3f6bb877ae9e241afd6a6a13d5a6afd692ddc0)
CVE-2017-13192
| -rw-r--r-- | decoder/ihevcd_parse_slice_header.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/decoder/ihevcd_parse_slice_header.c b/decoder/ihevcd_parse_slice_header.c index e1b50b7..ae19328 100644 --- a/decoder/ihevcd_parse_slice_header.c +++ b/decoder/ihevcd_parse_slice_header.c @@ -356,7 +356,7 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec, slice_address = value; /* If slice address is greater than the number of CTBs in a picture, * ignore the slice */ - if(value >= ps_sps->i4_pic_size_in_ctb) + if(value >= ps_sps->i4_pic_size_in_ctb || value <= 0) return IHEVCD_IGNORE_SLICE; } else |