diff options
| author | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | 2016-11-18 14:23:34 +0530 |
|---|---|---|
| committer | Sean McCreary <mccreary@mcwest.org> | 2017-03-22 20:06:57 -0600 |
| commit | 0b30413bdbb18e75af9a93b4b67f16c3aa14803f (patch) | |
| tree | c68b1a84ba1361088c25afff580d72ec70970c90 /decoder | |
| parent | 3b152ae7f484853e392b905113d301dc9691c289 (diff) | |
| download | android_external_libhevc-0b30413bdbb18e75af9a93b4b67f16c3aa14803f.tar.gz android_external_libhevc-0b30413bdbb18e75af9a93b4b67f16c3aa14803f.tar.bz2 android_external_libhevc-0b30413bdbb18e75af9a93b4b67f16c3aa14803f.zip | |
Fixed handling invalid chroma tu size for error clips
Limit func_idx to valid range to ensure invalid functions are not
called when wrong TU size is signalled for chroma due to error in
parsing
Bug: 32915871
CVE-2017-0406
AOSP Change-Id: I662212eb2e9b8994e7e85780e667f14df73b5905
Change-Id: I254bb3ffab57bc24e97f99d4d4f0ce4764802c50
(cherry picked from commit a76773ab749bd57f3467c79aa60c16c1f2c87380)
(cherry picked from commit 3da3ec6441c9694391efd9b758473c3f9c33f360)
Diffstat (limited to 'decoder')
| -rw-r--r-- | decoder/ihevcd_iquant_itrans_recon_ctb.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/decoder/ihevcd_iquant_itrans_recon_ctb.c b/decoder/ihevcd_iquant_itrans_recon_ctb.c index 88ace44..6009d09 100644 --- a/decoder/ihevcd_iquant_itrans_recon_ctb.c +++ b/decoder/ihevcd_iquant_itrans_recon_ctb.c @@ -886,6 +886,11 @@ WORD32 ihevcd_iquant_itrans_recon_ctb(process_ctxt_t *ps_proc) src_strd = trans_size; func_idx = 1 + 4 + log2_uv_trans_size_minus_2; /* DST func + Y funcs + cur func index*/ + + /* Handle error cases where 64x64 TU is signalled which results in 32x32 chroma. + * By limiting func_idx to 7, max of 16x16 chroma is called */ + func_idx = MIN(func_idx, 7); + e_trans_type = (TRANSFORM_TYPE)(log2_uv_trans_size_minus_2 + 1); /* QP for U */ i1_chroma_pic_qp_offset = ps_pps->i1_pic_cb_qp_offset; |