From 1c2342b48e1fb428a6a3de30a9537dddb003a939 Mon Sep 17 00:00:00 2001 From: Neelkamal Semwal Date: Tue, 10 May 2022 16:57:00 +0530 Subject: decoder: Fix integer overflow in ihevcd_parse_pred_wt_ofst Bug: 228326749 Test: poc in bug Test: atest CtsMediaTestCases:VideoDecoderTest Test: atest CtsMediaV2TestCases:CodecDecoderTest Test: atest VtsHalMediaC2V1_0TargetVideoDecTest Change-Id: Ifd63a964bc66c615d151877abbf06c1eeef0fc63 --- decoder/ihevcd_parse_headers.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c index e16a9e6..f70e150 100644 --- a/decoder/ihevcd_parse_headers.c +++ b/decoder/ihevcd_parse_headers.c @@ -168,6 +168,11 @@ WORD32 ihevcd_parse_pred_wt_ofst(bitstrm_t *ps_bitstrm, if(ps_sps->i1_chroma_format_idc != 0) { SEV_PARSE("delta_chroma_log2_weight_denom", value, ps_bitstrm); + if((value < -7) || (value > 7)) + { + return IHEVCD_INVALID_PARAMETER; + } + if(((ps_wt_ofst->i1_luma_log2_weight_denom + value) < 0) || ((ps_wt_ofst->i1_luma_log2_weight_denom + value) > 7)) { -- cgit v1.2.3