summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHarish Mahendrakar <harish.mahendrakar@ittiam.com>2017-01-13 11:23:29 +0530
committerSean McCreary <mccreary@mcwest.org>2017-03-22 12:25:51 -0600
commit9dd9ccf7d0c90640080fe35595517ef07a132123 (patch)
tree7a19e0ad8d78d3b501202ebfa33681e51346d438
parentd018f5d82d9a917915488e8cb2a22c67688ab788 (diff)
downloadandroid_external_libavc-9dd9ccf7d0c90640080fe35595517ef07a132123.tar.gz
android_external_libavc-9dd9ccf7d0c90640080fe35595517ef07a132123.tar.bz2
android_external_libavc-9dd9ccf7d0c90640080fe35595517ef07a132123.zip
Decoder: Fixed an out of bound access while parsing SEI
Invalid SPS Id read was resulting in an out of bound read Bug: 33552073 CVE-2017-0495 Change-Id: Ie5b80222fc7ac3a64475340371be0facdf999d7b (cherry picked from commit d3d60c6a5d7ab605d19b9ac4b95bc227b7b870dc) (cherry picked from commit 99a85bb4690dd30871d9457c30ca3b44a0928cc1) (cherry picked from commit 85c0ec4106659a11c220cd1210f8d76c33d9e2ae)
-rw-r--r--decoder/ih264d_sei.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/decoder/ih264d_sei.c b/decoder/ih264d_sei.c
index 14ffcd6..800f2c9 100644
--- a/decoder/ih264d_sei.c
+++ b/decoder/ih264d_sei.c
@@ -80,7 +80,7 @@ WORD32 ih264d_parse_buffering_period(buf_period_t *ps_buf_prd,
UNUSED(ps_buf_prd);
u1_seq_parameter_set_id = ih264d_uev(pu4_bitstrm_ofst,
pu4_bitstrm_buf);
- if(u1_seq_parameter_set_id > MAX_NUM_SEQ_PARAMS)
+ if(u1_seq_parameter_set_id >= MAX_NUM_SEQ_PARAMS)
return ERROR_INVALID_SEQ_PARAM;
ps_seq = &ps_dec->ps_sps[u1_seq_parameter_set_id];
if(TRUE != ps_seq->u1_is_valid)