diff options
| author | Venkatarama Avadhani <venkatarama.avadhani@ittiam.com> | 2017-06-27 11:55:32 +0530 |
|---|---|---|
| committer | Nikoli Cartagena <dargeren@google.com> | 2017-09-19 15:42:22 -0700 |
| commit | 08d17149ab10a91c6e4d109642473c41b7460f35 (patch) | |
| tree | f7ee799fadfe732c2dfd0d88dfc9cce889997281 | |
| parent | 67085f9fadef60f9a60d967050da41ef970e8893 (diff) | |
| download | platform_external_libmpeg2-08d17149ab10a91c6e4d109642473c41b7460f35.tar.gz platform_external_libmpeg2-08d17149ab10a91c6e4d109642473c41b7460f35.tar.bz2 platform_external_libmpeg2-08d17149ab10a91c6e4d109642473c41b7460f35.zip | |
Check Number of MBs to Skip.
The number of skip mbs was parsed as 0 and impeg2d_dec_skip_mbs was getting
called with a large number because of underflow.
Added a check for the same
Bug: 63125953
Test: run PoC on ASAN-enabled mpeg2dec before/after
Change-Id: I07f43c1745e38e800751997e97d44d2bab0615a8
(cherry picked from commit 89b4c1cf9e2d18c27c2d9c8c7504e5e2d79ef289)
| -rw-r--r-- | decoder/impeg2d_pnb_pic.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/decoder/impeg2d_pnb_pic.c b/decoder/impeg2d_pnb_pic.c index 69277e5..570f0d2 100644 --- a/decoder/impeg2d_pnb_pic.c +++ b/decoder/impeg2d_pnb_pic.c @@ -77,6 +77,12 @@ WORD32 impeg2d_dec_p_mb_params(dec_state_t *ps_dec) else { u2_mb_addr_incr = impeg2d_get_mb_addr_incr(ps_stream); + + if(!u2_mb_addr_incr) + { + return IV_FAIL; + } + if(0 == ps_dec->u2_first_mb) { /****************************************************************/ |