diff options
| author | Venkatarama Avadhani <venkatarama.avadhani@ittiam.com> | 2017-04-20 09:26:54 +0530 |
|---|---|---|
| committer | Ivan Kutepov <its.kutepov@gmail.com> | 2017-08-13 19:03:25 +0300 |
| commit | b12db6d805c435eceff6f765cc98a0fb3a90e8d3 (patch) | |
| tree | e0a3361ba8b102914f9bbcc7c69b2a22a51a0dc7 | |
| parent | abe50940c95727d1b878216190aff7d11abd37d1 (diff) | |
| download | android_external_libmpeg2-b12db6d805c435eceff6f765cc98a0fb3a90e8d3.tar.gz android_external_libmpeg2-b12db6d805c435eceff6f765cc98a0fb3a90e8d3.tar.bz2 android_external_libmpeg2-b12db6d805c435eceff6f765cc98a0fb3a90e8d3.zip | |
Adding Error Check For PictureStructure Param
Checking to ensure the picture structure read in dec_pic_coding_ext is
valid. If invalid, decode should not procede because the buffer obtained
to decode a picture with invalid picture structure will not be freed.
Bug: 37273673
Change-Id: I1469bb7b5daeab285ad55dcb77f54d0cb5d19dad
(cherry picked from commit f7546c1710348b975e204b07317a7bfb3c9c69de)
| -rw-r--r-- | decoder/impeg2d_dec_hdr.c | 17 |
1 files changed, 14 insertions, 3 deletions
diff --git a/decoder/impeg2d_dec_hdr.c b/decoder/impeg2d_dec_hdr.c index 99c659c..9e5fc2b 100644 --- a/decoder/impeg2d_dec_hdr.c +++ b/decoder/impeg2d_dec_hdr.c @@ -702,11 +702,12 @@ IMPEG2D_ERROR_CODES_T impeg2d_dec_pic_hdr(dec_state_t *ps_dec) * Arguments : * dec : Decoder context * -* Values Returned : None +* Values Returned : Error *******************************************************************************/ -void impeg2d_dec_pic_coding_ext(dec_state_t *ps_dec) +IMPEG2D_ERROR_CODES_T impeg2d_dec_pic_coding_ext(dec_state_t *ps_dec) { stream_t *ps_stream; + IMPEG2D_ERROR_CODES_T e_error = (IMPEG2D_ERROR_CODES_T) IV_SUCCESS; ps_stream = &ps_dec->s_bit_stream; impeg2d_bit_stream_flush(ps_stream,START_CODE_LEN); @@ -719,6 +720,11 @@ void impeg2d_dec_pic_coding_ext(dec_state_t *ps_dec) ps_dec->au2_f_code[1][1] = impeg2d_bit_stream_get(ps_stream,4); ps_dec->u2_intra_dc_precision = impeg2d_bit_stream_get(ps_stream,2); ps_dec->u2_picture_structure = impeg2d_bit_stream_get(ps_stream,2); + if (ps_dec->u2_picture_structure < TOP_FIELD || + ps_dec->u2_picture_structure > FRAME_PICTURE) + { + return IMPEG2D_FRM_HDR_DECODE_ERR; + } ps_dec->u2_top_field_first = impeg2d_bit_stream_get_bit(ps_stream); ps_dec->u2_frame_pred_frame_dct = impeg2d_bit_stream_get_bit(ps_stream); ps_dec->u2_concealment_motion_vectors = impeg2d_bit_stream_get_bit(ps_stream); @@ -746,6 +752,7 @@ void impeg2d_dec_pic_coding_ext(dec_state_t *ps_dec) { ps_dec->pu1_inv_scan_matrix = (UWORD8 *)gau1_impeg2_inv_scan_zig_zag; } + return e_error; } /******************************************************************************* @@ -1710,7 +1717,11 @@ IMPEG2D_ERROR_CODES_T impeg2d_process_video_bit_stream(dec_state_t *ps_dec) { return e_error; } - impeg2d_dec_pic_coding_ext(ps_dec); + e_error = impeg2d_dec_pic_coding_ext(ps_dec); + if ((IMPEG2D_ERROR_CODES_T)IVD_ERROR_NONE != e_error) + { + return e_error; + } e_error = impeg2d_dec_pic_ext_data(ps_dec); if ((IMPEG2D_ERROR_CODES_T)IVD_ERROR_NONE != e_error) { |