diff options
| author | Naveen Kumar P <naveenkumar.p@ittiam.com> | 2018-03-09 16:25:56 +0530 |
|---|---|---|
| committer | MSe <mse1969@posteo.de> | 2018-06-08 19:31:11 +0200 |
| commit | ed02579a01c251af05781f3e75252b3bb6397777 (patch) | |
| tree | d9d32e7ec02892adfaf8212c3927d12d35d3db4a | |
| parent | 6bd8b4b37414a9115fb0876070a30e8c7d80ff4f (diff) | |
| download | android_external_libhevc-ed02579a01c251af05781f3e75252b3bb6397777.tar.gz android_external_libhevc-ed02579a01c251af05781f3e75252b3bb6397777.tar.bz2 android_external_libhevc-ed02579a01c251af05781f3e75252b3bb6397777.zip | |
Add limits check for depth hierarchy sps parametersreplicant-6.0-0004-rc1
Bug: 73965890
Test: run poc before/after
According to the hevc specification, max_transform_hierarchy_depth_inter
and max_transform_hierarchy_depth_intra cannot be greater than
difference between log2_ctb_size and log2_min_transform_block_size.
Change-Id: I9a6f56b029957cead3e81bd07d7fb8392a1a98a2
(cherry picked from commit f7287c7993a0d61abccfdc530f388b366139ac1d)
CVE-2018-9353
| -rw-r--r-- | decoder/ihevcd_parse_headers.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c index 76d7914..6b7d2bf 100644 --- a/decoder/ihevcd_parse_headers.c +++ b/decoder/ihevcd_parse_headers.c @@ -1421,9 +1421,17 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) ps_sps->i1_log2_diff_max_min_pcm_coding_block_size = 0; UEV_PARSE("max_transform_hierarchy_depth_inter", value, ps_bitstrm); + if(value < 0 || value > (ps_sps->i1_log2_ctb_size - ps_sps->i1_log2_min_transform_block_size)) + { + return IHEVCD_INVALID_PARAMETER; + } ps_sps->i1_max_transform_hierarchy_depth_inter = value; UEV_PARSE("max_transform_hierarchy_depth_intra", value, ps_bitstrm); + if(value < 0 || value > (ps_sps->i1_log2_ctb_size - ps_sps->i1_log2_min_transform_block_size)) + { + return IHEVCD_INVALID_PARAMETER; + } ps_sps->i1_max_transform_hierarchy_depth_intra = value; /* String has a d (enabled) in order to match with HM */ |