diff options
| author | Naveen Kumar P <naveenkumar.p@ittiam.com> | 2017-05-17 14:15:44 +0530 |
|---|---|---|
| committer | MSe <mse1969@posteo.de> | 2018-06-08 19:30:42 +0200 |
| commit | 09f8990ab332343abf1da6e703287e03e2669291 (patch) | |
| tree | 0abf7cd10b420124636249bd126f8536d1e30a7a /decoder | |
| parent | 9648e375eab80ef82b2d11f85d2d153a01d97902 (diff) | |
| download | android_external_libhevc-09f8990ab332343abf1da6e703287e03e2669291.tar.gz android_external_libhevc-09f8990ab332343abf1da6e703287e03e2669291.tar.bz2 android_external_libhevc-09f8990ab332343abf1da6e703287e03e2669291.zip | |
Return error for invalid reorder parameter
Bug: 62689208
Test: before/after process PoC on ASAN builds.
Change-Id: Ib1404bdf512fba28c2641f3f2022811a2a2d7751
(cherry picked from commit 4286d31e9e121e1005ad8986bcbf9ba3f62122ee)
CVE-2018-9352
Diffstat (limited to 'decoder')
| -rw-r--r-- | decoder/ihevcd_parse_headers.c | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c index 4749ab2..4769355 100644 --- a/decoder/ihevcd_parse_headers.c +++ b/decoder/ihevcd_parse_headers.c @@ -1334,20 +1334,18 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) for(; i < ps_sps->i1_sps_max_sub_layers; i++) { UEV_PARSE("max_dec_pic_buffering", value, ps_bitstrm); - ps_sps->ai1_sps_max_dec_pic_buffering[i] = value + 1; - - if(ps_sps->ai1_sps_max_dec_pic_buffering[i] > MAX_DPB_SIZE) + if((value + 1) > MAX_DPB_SIZE) { return IHEVCD_INVALID_PARAMETER; } + ps_sps->ai1_sps_max_dec_pic_buffering[i] = value + 1; UEV_PARSE("num_reorder_pics", value, ps_bitstrm); - ps_sps->ai1_sps_max_num_reorder_pics[i] = value; - - if(ps_sps->ai1_sps_max_num_reorder_pics[i] > ps_sps->ai1_sps_max_dec_pic_buffering[i]) + if(value > ps_sps->ai1_sps_max_dec_pic_buffering[i]) { return IHEVCD_INVALID_PARAMETER; } + ps_sps->ai1_sps_max_num_reorder_pics[i] = value; UEV_PARSE("max_latency_increase", value, ps_bitstrm); ps_sps->ai1_sps_max_latency_increase[i] = value; |