diff options
| author | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | 2017-05-03 15:12:46 +0530 |
|---|---|---|
| committer | Ivan Kutepov <its.kutepov@gmail.com> | 2017-10-04 15:24:53 +0300 |
| commit | 8e9a778e663a90f8a5852ddf943c5193cc340093 (patch) | |
| tree | 00961f2026451073f108e28d0357d0728bbb3eae | |
| parent | 811e5dc572678822611f22c02d466ede5edfedb7 (diff) | |
| download | android_external_libhevc-8e9a778e663a90f8a5852ddf943c5193cc340093.tar.gz android_external_libhevc-8e9a778e663a90f8a5852ddf943c5193cc340093.tar.bz2 android_external_libhevc-8e9a778e663a90f8a5852ddf943c5193cc340093.zip | |
Ensure CTB size > 16 for clips with tiles and width/height >= 4096
For clips with tiles and dimensions >= 4096,
CTB size of 16 can result in tile position > 255.
This is not supported by the decoder
Bug: 37930177
Test: ran poc w/o crashing
Change-Id: I2f223a124c4ea9bfd98343343fd010d80a5dd8bd
(cherry picked from commit 248e72c7a8c7c382ff4397868a6c7453a6453141)
CVE-2017-0811
| -rw-r--r-- | decoder/ihevcd_parse_headers.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c index a33a382..06f5ef1 100644 --- a/decoder/ihevcd_parse_headers.c +++ b/decoder/ihevcd_parse_headers.c @@ -1811,6 +1811,19 @@ IHEVCD_ERROR_T ihevcd_parse_pps(codec_t *ps_codec) BITS_PARSE("tiles_enabled_flag", value, ps_bitstrm, 1); ps_pps->i1_tiles_enabled_flag = value; + /* When tiles are enabled and width or height is >= 4096, + * CTB Size should at least be 32. 16x16 CTBs can result + * in tile position greater than 255 for 4096, + * which decoder does not support. + */ + if((ps_pps->i1_tiles_enabled_flag) && + (ps_sps->i1_log2_ctb_size == 4) && + ((ps_sps->i2_pic_width_in_luma_samples >= 4096) || + (ps_sps->i2_pic_height_in_luma_samples >= 4096))) + { + return IHEVCD_INVALID_HEADER; + } + BITS_PARSE("entropy_coding_sync_enabled_flag", value, ps_bitstrm, 1); ps_pps->i1_entropy_coding_sync_enabled_flag = value; |