diff options
| author | Venkatarama Avadhani <venkatarama.avadhani@ittiam.com> | 2017-08-09 12:11:38 +0530 |
|---|---|---|
| committer | MSe <mse1969@posteo.de> | 2018-01-10 22:42:03 +0100 |
| commit | 53442e5649adc0164854c24debe561cfe62e2122 (patch) | |
| tree | 52d798403b3f5a3575e266555c59a1c03f3e02c4 /decoder/impeg2d_pic_proc.c | |
| parent | a82c5a11f8345f3e0fb53fa3f7a127d9b7ab9913 (diff) | |
| download | android_external_libmpeg2-53442e5649adc0164854c24debe561cfe62e2122.tar.gz android_external_libmpeg2-53442e5649adc0164854c24debe561cfe62e2122.tar.bz2 android_external_libmpeg2-53442e5649adc0164854c24debe561cfe62e2122.zip | |
Adding Error Check for f_code Parameters
In MPEG1, the valid range for the forward and backward f_code parameters
is [1, 7]. Adding a check to enforce this. Without the check, the value
could be 0. We read (f_code - 1) bits from the stream and reading a
negative number of bits from the stream is undefined.
Bug: 64550583
Test: monitored temp ALOGD() output
Change-Id: Ia452cd43a28e9d566401f515947164635361782f
(cherry picked from commit 71d734b83d72e8a59f73f1230982da97615d2689)
CVE-2017-13205
Diffstat (limited to 'decoder/impeg2d_pic_proc.c')
| -rw-r--r-- | decoder/impeg2d_pic_proc.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/decoder/impeg2d_pic_proc.c b/decoder/impeg2d_pic_proc.c index fbbbf79..6826def 100644 --- a/decoder/impeg2d_pic_proc.c +++ b/decoder/impeg2d_pic_proc.c @@ -271,6 +271,8 @@ IMPEG2D_ERROR_CODES_T impeg2d_init_video_state(dec_state_t *ps_dec, e_video_type ps_dec->u2_progressive_frame = 1; ps_dec->u2_frame_rate_extension_n = 0; ps_dec->u2_frame_rate_extension_d = 0; + ps_dec->u2_forw_f_code = 7; + ps_dec->u2_back_f_code = 7; ps_dec->pf_vld_inv_quant = impeg2d_vld_inv_quant_mpeg1; /*-------------------------------------------------------------------*/ |