diff options
| author | TreeHugger Robot <treehugger-gerrit@google.com> | 2020-03-20 03:31:35 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2020-03-20 03:31:35 +0000 |
| commit | 416f706deb68e71e6dfe187e5e742ebe435a7836 (patch) | |
| tree | 55237913f6dc8f94f75c144c3a0f2bdf43931209 | |
| parent | f76644ac429949da5ae33d7daf15ad5e5e224fb7 (diff) | |
| parent | 87bfb89bde627965fc53135a8142d2d667d7bc10 (diff) | |
| download | libhevc-416f706deb68e71e6dfe187e5e742ebe435a7836.tar.gz | |
Merge "decoder: Fix integer overflow while parsing num_long_term_pics" into qt-qpr1-dev am: 1e1b2c7f1e am: 7d3d14afcf am: 87bfb89bde
Change-Id: I7969cfdaf42f47386ad8387ef8ca01c0250524ef
| -rw-r--r-- | decoder/ihevcd_parse_slice_header.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/decoder/ihevcd_parse_slice_header.c b/decoder/ihevcd_parse_slice_header.c index 8f8864e..e452488 100644 --- a/decoder/ihevcd_parse_slice_header.c +++ b/decoder/ihevcd_parse_slice_header.c @@ -477,7 +477,8 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec, ps_slice_hdr->i1_num_long_term_sps = value; } UEV_PARSE("num_long_term_pics", value, ps_bitstrm); - if((value + ps_slice_hdr->i1_num_long_term_sps + num_neg_pics + num_pos_pics) > (MAX_DPB_SIZE - 1)) + if(((ULWORD64)value + ps_slice_hdr->i1_num_long_term_sps + num_neg_pics + + num_pos_pics) > (MAX_DPB_SIZE - 1)) { return IHEVCD_INVALID_PARAMETER; } @@ -493,6 +494,10 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec, { WORD32 num_bits = 32 - CLZ(ps_sps->i1_num_long_term_ref_pics_sps - 1); BITS_PARSE("lt_idx_sps[ i ]", value, ps_bitstrm, num_bits); + if(value >= ps_sps->i1_num_long_term_ref_pics_sps) + { + return IHEVCD_INVALID_PARAMETER; + } } else { |