diff options
| author | Marco Nelissen <marcone@google.com> | 2017-09-14 01:25:11 +0000 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2017-09-14 01:25:11 +0000 |
| commit | a2c59e3ab3149f151043cfc7869d743671c06579 (patch) | |
| tree | 35c4ebf59f0e00c286ef26892f8539de674c1dfe | |
| parent | 0c7553aafa8775af8a53998ac69a12796e91d250 (diff) | |
| parent | bd336ce65e5e5dfa88e30d62451d6d2366bd7b00 (diff) | |
| download | android_external_libavc-a2c59e3ab3149f151043cfc7869d743671c06579.tar.gz android_external_libavc-a2c59e3ab3149f151043cfc7869d743671c06579.tar.bz2 android_external_libavc-a2c59e3ab3149f151043cfc7869d743671c06579.zip | |
Merge "Decoder: Updated error check while parsing num_ref_idx_lx_active." into mnc-dev am: 224824ba17 am: 628056c0ed am: becbdb15b7 am: 2f85a749c5 am: bd6a74b45b am: 828dc44ed5 am: a1d4d39a61 am: b4f8a983ad am: d3ea876a4d am: 957708e9b1 am: 0c909b99f0
am: bd336ce65e
Change-Id: I0f46d2f751bac9110da556fc930f33cd834dd562
| -rw-r--r-- | decoder/ih264d_parse_bslice.c | 3 | ||||
| -rw-r--r-- | decoder/ih264d_parse_pslice.c | 2 |
2 files changed, 3 insertions, 2 deletions
diff --git a/decoder/ih264d_parse_bslice.c b/decoder/ih264d_parse_bslice.c index 4418429..f087f8d 100644 --- a/decoder/ih264d_parse_bslice.c +++ b/decoder/ih264d_parse_bslice.c @@ -1399,7 +1399,8 @@ WORD32 ih264d_parse_bslice(dec_struct_t * ps_dec, UWORD16 u2_first_mb_in_slice) { u1_max_ref_idx = MAX_FRAMES << 1; } - if((u4_temp > u1_max_ref_idx) || (ui_temp1 > u1_max_ref_idx)) + if((u4_temp > u1_max_ref_idx) || (ui_temp1 > u1_max_ref_idx) + || (u4_temp < 1) || (ui_temp1 < 1)) { return ERROR_NUM_REF; } diff --git a/decoder/ih264d_parse_pslice.c b/decoder/ih264d_parse_pslice.c index d6b0f23..9b9256b 100644 --- a/decoder/ih264d_parse_pslice.c +++ b/decoder/ih264d_parse_pslice.c @@ -1961,7 +1961,7 @@ WORD32 ih264d_parse_pslice(dec_struct_t *ps_dec, UWORD16 u2_first_mb_in_slice) UWORD8 u1_max_ref_idx = MAX_FRAMES << u1_field_pic_flag; - if(u4_temp > u1_max_ref_idx) + if(u4_temp > u1_max_ref_idx || u4_temp < 1) { return ERROR_NUM_REF; } |