diff options
| author | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | 2016-11-10 14:28:28 +0530 |
|---|---|---|
| committer | Sean McCreary <mccreary@mcwest.org> | 2017-03-22 20:06:26 -0600 |
| commit | a9f92961ff040a3ee62c08f7f35cd87ebf5dc029 (patch) | |
| tree | 1b01c3f2b79191cd66e05293a8f91db8bfacf59f | |
| parent | cc92338e922f8cc7d84220c9da98a81e2408d7e8 (diff) | |
| download | android_external_libhevc-a9f92961ff040a3ee62c08f7f35cd87ebf5dc029.tar.gz android_external_libhevc-a9f92961ff040a3ee62c08f7f35cd87ebf5dc029.tar.bz2 android_external_libhevc-a9f92961ff040a3ee62c08f7f35cd87ebf5dc029.zip | |
Handle invalid slice_address in slice header
If an invalid slice_address was parsed, it was resulting in an incomplete
slice header during decode stage. Fix this by not incrementing slice_idx
for ignore slice error
Bug: 32322258
CVE-2017-0391
AOSP Change-Id: I8638d7094d65f4409faa9b9e337ef7e7b64505de
Change-Id: I7f477b886d746bcccfc9a59702995a5b73b36cc8
(cherry picked from commit f4f3556e04a9776bcc776523ae0763e7d0d5c668)
(cherry picked from commit 545647452fe279a82c61eb668ed2859d777bbd4c)
| -rw-r--r-- | decoder/ihevcd_decode.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/decoder/ihevcd_decode.c b/decoder/ihevcd_decode.c index 954f8f3..d656519 100644 --- a/decoder/ihevcd_decode.c +++ b/decoder/ihevcd_decode.c @@ -628,6 +628,7 @@ WORD32 ihevcd_decode(iv_obj_t *ps_codec_obj, void *pv_api_ip, void *pv_api_op) if(IHEVCD_IGNORE_SLICE == ret) { + ps_codec->s_parse.i4_cur_slice_idx = MAX(0, (ps_codec->s_parse.i4_cur_slice_idx - 1)); ps_codec->pu1_inp_bitsbuf += (nal_ofst + nal_len); ps_codec->i4_bytes_remaining -= (nal_ofst + nal_len); |