Merge cherrypicks of [4254030, 4254031, 4254032, 4254033, 4254082, 4254083, 4254084, 4254085, 4254601, 4254602, 4254086, 4254087, 4254088, 4254089, 4254090, 4254091, 4254092, 4254093, 4254621, 4254209, 4254105, 4254106, 4254107, 4254108, 4254109, 4254110, 4254111, 4254134, 4254135, 4254136, 4254137, 4254138, 4254139, 4254140, 4254661, 4254662, 4254663, 4254664, 4254094, 4254034, 4254035, 4254036, 4254681, 4253166, 4253167, 4254644, 4254210, 4254095, 4254701, 4254702, 4254112, 4254113, 4254114, 4254115, 4254116, 4254117, 4254118, 4254119, 4254120, 4254721, 4254722, 4254723, 4254724, 4254725, 4253345, 4253168, 4254573, 4253169, 4254211, 4254096, 4253346, 4253347, 4254212, 4254574, 4254575, 4254576, 4254577, 4254578] into sparse-4732990-L64400000179192834android-8.1.0_r35oreo-m2-s4-release

Change-Id: Ieca3bd724a45d18f88b028be7f5839cfebbd62c9

2 files changed, 21 insertions, 9 deletions

diff --git a/common/ihevc_defs.h b/common/ihevc_defs.h
index 13b0239..1878f30 100644
--- a/common/ihevc_defs.h
+++ b/common/ihevc_defs.h
@@ -313,7 +313,7 @@ enum
 #define SPS_MAX_SUB_LAYERS  7
 
 /* Maximum long term reference pics */
-#define MAX_LTREF_PICS_SPS 16
+#define MAX_LTREF_PICS_SPS 32
 
 #define MAX_STREF_PICS_SPS 64
 
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index b8ed252..383204c 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1414,20 +1414,18 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
     for(; i < ps_sps->i1_sps_max_sub_layers; i++)
     {
         UEV_PARSE("max_dec_pic_buffering", value, ps_bitstrm);
-        ps_sps->ai1_sps_max_dec_pic_buffering[i] = value + 1;
-
-        if(ps_sps->ai1_sps_max_dec_pic_buffering[i] > MAX_DPB_SIZE)
+        if(value < 0 || (value + 1) > MAX_DPB_SIZE)
         {
             return IHEVCD_INVALID_PARAMETER;
         }
+        ps_sps->ai1_sps_max_dec_pic_buffering[i] = value + 1;
 
         UEV_PARSE("num_reorder_pics", value, ps_bitstrm);
-        ps_sps->ai1_sps_max_num_reorder_pics[i] = value;
-
-        if(ps_sps->ai1_sps_max_num_reorder_pics[i] > ps_sps->ai1_sps_max_dec_pic_buffering[i])
+        if(value < 0 || value > ps_sps->ai1_sps_max_dec_pic_buffering[i])
         {
             return IHEVCD_INVALID_PARAMETER;
         }
+        ps_sps->ai1_sps_max_num_reorder_pics[i] = value;
 
         UEV_PARSE("max_latency_increase", value, ps_bitstrm);
         ps_sps->ai1_sps_max_latency_increase[i] = value;
@@ -1503,9 +1501,17 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
     ps_sps->i1_log2_diff_max_min_pcm_coding_block_size = 0;
 
     UEV_PARSE("max_transform_hierarchy_depth_inter", value, ps_bitstrm);
+    if(value < 0 || value > (ps_sps->i1_log2_ctb_size - ps_sps->i1_log2_min_transform_block_size))
+    {
+        return IHEVCD_INVALID_PARAMETER;
+    }
     ps_sps->i1_max_transform_hierarchy_depth_inter = value;
 
     UEV_PARSE("max_transform_hierarchy_depth_intra", value, ps_bitstrm);
+    if(value < 0 || value > (ps_sps->i1_log2_ctb_size - ps_sps->i1_log2_min_transform_block_size))
+    {
+        return IHEVCD_INVALID_PARAMETER;
+    }
     ps_sps->i1_max_transform_hierarchy_depth_intra = value;
 
     /* String has a d (enabled) in order to match with HM */
@@ -1553,10 +1559,12 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
 
     }
     UEV_PARSE("num_short_term_ref_pic_sets", value, ps_bitstrm);
+    if(value < 0 || value > MAX_STREF_PICS_SPS)
+    {
+        return IHEVCD_INVALID_PARAMETER;
+    }
     ps_sps->i1_num_short_term_ref_pic_sets = value;
 
-    ps_sps->i1_num_short_term_ref_pic_sets = CLIP3(ps_sps->i1_num_short_term_ref_pic_sets, 0, MAX_STREF_PICS_SPS);
-
     for(i = 0; i < ps_sps->i1_num_short_term_ref_pic_sets; i++)
         ihevcd_short_term_ref_pic_set(ps_bitstrm, &ps_sps->as_stref_picset[0], ps_sps->i1_num_short_term_ref_pic_sets, i, &ps_sps->as_stref_picset[i]);
 
@@ -1566,6 +1574,10 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec)
     if(ps_sps->i1_long_term_ref_pics_present_flag)
     {
         UEV_PARSE("num_long_term_ref_pics_sps", value, ps_bitstrm);
+        if(value < 0 || value > MAX_LTREF_PICS_SPS)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
         ps_sps->i1_num_long_term_ref_pics_sps = value;
 
         for(i = 0; i < ps_sps->i1_num_long_term_ref_pics_sps; i++)