From b93923e2883a2d1a4eb46290c3b15a84da808d66 Mon Sep 17 00:00:00 2001 From: Naveen Kumar P Date: Fri, 13 Apr 2018 13:55:43 +0530 Subject: Return error for invalid st/lt sps parameters When num_short_term_ref_pic_sets or num_long_term_ref_pics_sps in sps is out of range, error is returned. Bug: 77599438 Test: poc before/after Change-Id: I652d27849438c3ea2d42fc6e9abb8aeb25ebdc22 --- decoder/ihevcd_parse_headers.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'decoder') diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c index 5671524..9cabdde 100644 --- a/decoder/ihevcd_parse_headers.c +++ b/decoder/ihevcd_parse_headers.c @@ -1453,10 +1453,12 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) } UEV_PARSE("num_short_term_ref_pic_sets", value, ps_bitstrm); + if(value < 0 || value > MAX_STREF_PICS_SPS) + { + return IHEVCD_INVALID_PARAMETER; + } ps_sps->i1_num_short_term_ref_pic_sets = value; - ps_sps->i1_num_short_term_ref_pic_sets = CLIP3(ps_sps->i1_num_short_term_ref_pic_sets, 0, MAX_STREF_PICS_SPS); - for(i = 0; i < ps_sps->i1_num_short_term_ref_pic_sets; i++) ihevcd_short_term_ref_pic_set(ps_bitstrm, &ps_sps->as_stref_picset[0], ps_sps->i1_num_short_term_ref_pic_sets, i, &ps_sps->as_stref_picset[i]); @@ -1466,6 +1468,10 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) if(ps_sps->i1_long_term_ref_pics_present_flag) { UEV_PARSE("num_long_term_ref_pics_sps", value, ps_bitstrm); + if(value < 0 || value > MAX_LTREF_PICS_SPS) + { + return IHEVCD_INVALID_PARAMETER; + } ps_sps->i1_num_long_term_ref_pics_sps = value; for(i = 0; i < ps_sps->i1_num_long_term_ref_pics_sps; i++) -- cgit v1.2.3