diff options
| author | Naveen Kumar P <naveenkumar.p@ittiam.com> | 2018-03-09 08:34:01 +0530 |
|---|---|---|
| committer | MSe <mse1969@posteo.de> | 2018-06-08 19:30:59 +0200 |
| commit | 6bd8b4b37414a9115fb0876070a30e8c7d80ff4f (patch) | |
| tree | c6426bf331454319deee3edfa03d6fdb75ee77ae /decoder | |
| parent | 09f8990ab332343abf1da6e703287e03e2669291 (diff) | |
| download | android_external_libhevc-6bd8b4b37414a9115fb0876070a30e8c7d80ff4f.tar.gz android_external_libhevc-6bd8b4b37414a9115fb0876070a30e8c7d80ff4f.tar.bz2 android_external_libhevc-6bd8b4b37414a9115fb0876070a30e8c7d80ff4f.zip | |
Return error for invalid sps sub layers parameters
Return error for negative values of max_dec_pic_buffering and
num_reorder_pics sps parameters.
Bug: 73965867
Test: Ittiam
Change-Id: I6035b3b2fcbd29c6bbb1223f4714ba04b4bca6b3
(cherry picked from commit f4486cdb2ff81368baa1d6e7afcf2c06ba64e666)
CVE-2018-9352
Diffstat (limited to 'decoder')
| -rw-r--r-- | decoder/ihevcd_parse_headers.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c index 4769355..76d7914 100644 --- a/decoder/ihevcd_parse_headers.c +++ b/decoder/ihevcd_parse_headers.c @@ -1334,14 +1334,14 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) for(; i < ps_sps->i1_sps_max_sub_layers; i++) { UEV_PARSE("max_dec_pic_buffering", value, ps_bitstrm); - if((value + 1) > MAX_DPB_SIZE) + if(value < 0 || (value + 1) > MAX_DPB_SIZE) { return IHEVCD_INVALID_PARAMETER; } ps_sps->ai1_sps_max_dec_pic_buffering[i] = value + 1; UEV_PARSE("num_reorder_pics", value, ps_bitstrm); - if(value > ps_sps->ai1_sps_max_dec_pic_buffering[i]) + if(value < 0 || value > ps_sps->ai1_sps_max_dec_pic_buffering[i]) { return IHEVCD_INVALID_PARAMETER; } |