diff options
| author | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | 2017-01-13 17:46:11 +0530 |
|---|---|---|
| committer | Sean McCreary <mccreary@mcwest.org> | 2017-04-05 18:21:35 -0600 |
| commit | c14bbd45ac66a54a5acf995783b43a3b122cb16f (patch) | |
| tree | 2bc91d6d59d4c02451b5da1980a03cb2bfc7520d /decoder | |
| parent | d44b7efd33690d47e35e28266baac2f9999bd541 (diff) | |
| download | android_external_libhevc-c14bbd45ac66a54a5acf995783b43a3b122cb16f.tar.gz android_external_libhevc-c14bbd45ac66a54a5acf995783b43a3b122cb16f.tar.bz2 android_external_libhevc-c14bbd45ac66a54a5acf995783b43a3b122cb16f.zip | |
Handle invalid num_reorder_pics & max_dec_pic_buffering in SPS
Bug: 33864300
AOSP-Change-Id: I920e45c3420a1a41a366ad45bd4186c5f6af6d6b
CVE-2017-0539
Change-Id: Ibd55790a3b31ee345240f263e4a83d20d8f3120a
(cherry picked from commit 1ab5ce7e42feccd49e49752e6f58f9097ac5d254)
Diffstat (limited to 'decoder')
| -rw-r--r-- | decoder/ihevcd_parse_headers.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c index 17de2a2..3cae4e5 100644 --- a/decoder/ihevcd_parse_headers.c +++ b/decoder/ihevcd_parse_headers.c @@ -1312,9 +1312,19 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) UEV_PARSE("max_dec_pic_buffering", value, ps_bitstrm); ps_sps->ai1_sps_max_dec_pic_buffering[i] = value + 1; + if(ps_sps->ai1_sps_max_dec_pic_buffering[i] > MAX_DPB_SIZE) + { + return IHEVCD_INVALID_PARAMETER; + } + UEV_PARSE("num_reorder_pics", value, ps_bitstrm); ps_sps->ai1_sps_max_num_reorder_pics[i] = value; + if(ps_sps->ai1_sps_max_num_reorder_pics[i] > ps_sps->ai1_sps_max_dec_pic_buffering[i]) + { + return IHEVCD_INVALID_PARAMETER; + } + UEV_PARSE("max_latency_increase", value, ps_bitstrm); ps_sps->ai1_sps_max_latency_increase[i] = value; } |