diff options
| author | Naveen Kumar P <naveenkumar.p@ittiam.com> | 2017-08-04 16:42:37 +0530 |
|---|---|---|
| committer | MSe <mse1969@posteo.de> | 2018-01-10 20:56:49 +0100 |
| commit | b99b81c747d81834386d0cdcb01b719dfe6c7f67 (patch) | |
| tree | 2d59a85aafa7f445f47120afcab3e18d86be96a7 | |
| parent | 53b4d3b3ff61f79a095bf762b460d674270597bc (diff) | |
| download | android_external_libhevc-b99b81c747d81834386d0cdcb01b719dfe6c7f67.tar.gz android_external_libhevc-b99b81c747d81834386d0cdcb01b719dfe6c7f67.tar.bz2 android_external_libhevc-b99b81c747d81834386d0cdcb01b719dfe6c7f67.zip | |
Fix incomplete frame error
Bug: 63522067
Bug: 64380403
Test: ran POC before/after
Change-Id: If22f2ed8936e0ead9fcfa64ddde99e85c10cecd2
(cherry picked from commit ee0e003a0fd2280ecd0eeecd2e2f19250a96c3af)
CVE-2017-13191 / CVE-2017-13196
| -rw-r--r-- | decoder/ihevcd_decode.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/decoder/ihevcd_decode.c b/decoder/ihevcd_decode.c index 04ad8f5..44abcef 100644 --- a/decoder/ihevcd_decode.c +++ b/decoder/ihevcd_decode.c @@ -69,6 +69,7 @@ #include "ihevcd_fmt_conv.h" #include "ihevcd_job_queue.h" #include "ihevcd_debug.h" +#include "ihevcd_parse_slice.h" #include "ihevcd_process_slice.h" #include "ihevcd_ittiam_logo.h" #include "ihevcd_profile.h" @@ -698,6 +699,22 @@ WORD32 ihevcd_decode(iv_obj_t *ps_codec_obj, void *pv_api_ip, void *pv_api_op) return IV_FAIL; } + if(1 == ps_codec->i4_pic_present && 0 == ps_codec->s_parse.i4_end_of_frame) + { + slice_header_t *ps_slice_hdr_next; + ps_codec->i4_slice_error = 1; + ps_codec->s_parse.i4_cur_slice_idx--; + if(ps_codec->s_parse.i4_cur_slice_idx < 0) + ps_codec->s_parse.i4_cur_slice_idx = 0; + + ps_slice_hdr_next = ps_codec->s_parse.ps_slice_hdr_base + ((ps_codec->s_parse.i4_cur_slice_idx + 1) & (MAX_SLICE_HDR_CNT - 1)); + ps_slice_hdr_next->i2_ctb_x = -1; + ps_slice_hdr_next->i2_ctb_y = -1; + + ihevcd_parse_slice_data(ps_codec); + ASSERT(ps_codec->s_parse.i4_end_of_frame != 0); + } + if(1 == ps_codec->i4_pic_present) { WORD32 i; |