diff options
| author | Android Build Merger (Role) <noreply-android-build-merger@google.com> | 2019-04-23 22:07:31 +0000 |
|---|---|---|
| committer | Android Build Merger (Role) <noreply-android-build-merger@google.com> | 2019-04-23 22:07:31 +0000 |
| commit | 8ee7982e46b0e8a367bacb2eeb00efd722d81da7 (patch) | |
| tree | bb5b3de291fdfc5eedaa5a43bbcdfa206d0cbdf4 /decoder | |
| parent | 2c56677a61b06e6f5a15a10b10ceb4cfdd160416 (diff) | |
| parent | 05f83e945884735a665555d171dec4cfdefa3956 (diff) | |
| download | platform_external_libhevc-8ee7982e46b0e8a367bacb2eeb00efd722d81da7.tar.gz platform_external_libhevc-8ee7982e46b0e8a367bacb2eeb00efd722d81da7.tar.bz2 platform_external_libhevc-8ee7982e46b0e8a367bacb2eeb00efd722d81da7.zip | |
[automerger] Add bounds check for tile dimensions am: 05f83e9458
Change-Id: Ic7ecd009be03d4a991ffde51ba0081b4fc6998a6
Diffstat (limited to 'decoder')
| -rw-r--r-- | decoder/ihevcd_parse_headers.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c index af9903a..cbca398 100644 --- a/decoder/ihevcd_parse_headers.c +++ b/decoder/ihevcd_parse_headers.c @@ -1910,6 +1910,10 @@ IHEVCD_ERROR_T ihevcd_parse_pps(codec_t *ps_codec) { UEV_PARSE("column_width_minus1[ i ]", value, ps_bitstrm); value += 1; + if (value >= ps_sps->i2_pic_wd_in_ctb - start) + { + return IHEVCD_INVALID_HEADER; + } } else { @@ -1946,6 +1950,10 @@ IHEVCD_ERROR_T ihevcd_parse_pps(codec_t *ps_codec) UEV_PARSE("row_height_minus1[ i ]", value, ps_bitstrm); value += 1; + if (value >= ps_sps->i2_pic_ht_in_ctb - start) + { + return IHEVCD_INVALID_HEADER; + } } else { |