diff options
| author | Naveen Kumar P <naveenkumar.p@ittiam.com> | 2017-08-03 15:50:41 +0530 |
|---|---|---|
| committer | MSe <mse1969@posteo.de> | 2018-01-10 22:14:23 +0100 |
| commit | 567a98be9308fc0da5bb441d266e327eb88c7be7 (patch) | |
| tree | 01e6ee9b408c11ca1863f1f0f5925392af2fae99 /decoder | |
| parent | b56fef66b160d138ee3af5ffe625fdfbcf3d9a89 (diff) | |
| download | android_external_libhevc-567a98be9308fc0da5bb441d266e327eb88c7be7.tar.gz android_external_libhevc-567a98be9308fc0da5bb441d266e327eb88c7be7.tar.bz2 android_external_libhevc-567a98be9308fc0da5bb441d266e327eb88c7be7.zip | |
Fix prev slice incomplete check
Bug: 64552185
Bug: 65034175
Move the decision to signal missing ctbs as skipped ctbs of
previous slice to the end of current slice hdr parsing to
ensure no error in slice hdr parsing.
Change-Id: Ia33b4be31dad6225b04e7b20b9000059c87941c4
(cherry picked from commit 74f35f191022c06863dacd33a3651a33be3ef08d)
(cherry picked from commit 9c24714e25d6ba713549a573df1d496479dce2b1)
CVE-2017-13187
Diffstat (limited to 'decoder')
| -rw-r--r-- | decoder/ihevcd_parse_slice_header.c | 23 |
1 files changed, 12 insertions, 11 deletions
diff --git a/decoder/ihevcd_parse_slice_header.c b/decoder/ihevcd_parse_slice_header.c index ae19328..8dd3b13 100644 --- a/decoder/ihevcd_parse_slice_header.c +++ b/decoder/ihevcd_parse_slice_header.c @@ -234,6 +234,7 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec, WORD8 i1_nal_unit_type = ps_nal->i1_nal_unit_type; WORD32 num_poc_total_curr = 0; WORD32 slice_address; + WORD32 prev_slice_incomplete_flag = 0; if(ps_codec->i4_slice_error == 1) return ret; @@ -730,16 +731,7 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec, { if(ps_codec->i4_pic_present) { - slice_header_t *ps_slice_hdr_next; - ps_codec->i4_slice_error = 1; - ps_codec->s_parse.i4_cur_slice_idx--; - if(ps_codec->s_parse.i4_cur_slice_idx < 0) - ps_codec->s_parse.i4_cur_slice_idx = 0; - - ps_slice_hdr_next = ps_codec->s_parse.ps_slice_hdr_base + ((ps_codec->s_parse.i4_cur_slice_idx + 1) & (MAX_SLICE_HDR_CNT - 1)); - ps_slice_hdr_next->i2_ctb_x = slice_address % ps_sps->i2_pic_wd_in_ctb; - ps_slice_hdr_next->i2_ctb_y = slice_address / ps_sps->i2_pic_wd_in_ctb; - return ret; + prev_slice_incomplete_flag = 1; } else { @@ -1009,7 +1001,8 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec, slice_header_t *ps_slice_hdr_prev = ps_codec->s_parse.ps_slice_hdr_base; ihevcd_copy_slice_hdr(ps_codec, 0, (ps_codec->s_parse.i4_cur_slice_idx & (MAX_SLICE_HDR_CNT - 1))); - ps_codec->i4_slice_error = 1; + prev_slice_incomplete_flag = 1; + ASSERT(ps_codec->s_parse.i4_cur_slice_idx == 1); ps_slice_hdr_prev->i2_ctb_x = 0; ps_slice_hdr_prev->i2_ctb_y = 0; @@ -1048,5 +1041,13 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec, } } + if(prev_slice_incomplete_flag) + { + ps_codec->i4_slice_error = 1; + ps_codec->s_parse.i4_cur_slice_idx--; + if(ps_codec->s_parse.i4_cur_slice_idx < 0) + ps_codec->s_parse.i4_cur_slice_idx = 0; + } + return ret; } |