From 3abab0f52abf1eac210c7660bb9e3ddae38cbcaa Mon Sep 17 00:00:00 2001
From: Harish Mahendrakar <harish.mahendrakar@ittiam.com>
Date: Fri, 18 Sep 2015 15:15:50 +0530
Subject: [PATCH] Return error in SPS/PPS parsing when extra bytes are read
 from input

Bugfix: 24157524

Change-Id: I4b319ef8e23e1ba5f84f52b92f40ba7fb1429101
---
 decoder/ih264d_parse_headers.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/decoder/ih264d_parse_headers.c b/decoder/ih264d_parse_headers.c
index cac7d21..94ec8a8 100644
--- a/decoder/ih264d_parse_headers.c
+++ b/decoder/ih264d_parse_headers.c
@@ -368,6 +368,12 @@ WORD32 ih264d_parse_pps(dec_struct_t * ps_dec, dec_bit_stream_t * ps_bitstrm)
             return ERROR_INV_RANGE_QP_T;
     }
 
+    /* In case bitstream read has exceeded the filled size, then
+       return an error */
+    if(ps_bitstrm->u4_ofst > ps_bitstrm->u4_max_ofst + 8)
+    {
+        return ERROR_INV_SPS_PPS_T;
+    }
     ps_pps->u1_is_valid = TRUE;
     ps_dec->ps_pps[ps_pps->u1_pic_parameter_set_id] = *ps_pps;
     return OK;
@@ -898,8 +904,6 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
 
     }
 
-    ps_seq->u1_is_valid = TRUE;
-
     if(1 == ps_seq->u1_vui_parameters_present_flag)
     {
         ret = ih264d_parse_vui_parametres(&ps_seq->s_vui, ps_bitstrm);
@@ -925,6 +929,13 @@ WORD32 ih264d_parse_sps(dec_struct_t *ps_dec, dec_bit_stream_t *ps_bitstrm)
     ps_dec->u2_crop_offset_y = u2_crop_offset_y;
     ps_dec->u2_crop_offset_uv = u2_crop_offset_uv;
 
+    /* In case bitstream read has exceeded the filled size, then
+       return an error */
+    if(ps_bitstrm->u4_ofst > ps_bitstrm->u4_max_ofst)
+    {
+        return ERROR_INV_SPS_PPS_T;
+    }
+    ps_seq->u1_is_valid = TRUE;
     ps_dec->ps_sps[u1_seq_parameter_set_id] = *ps_seq;
 
     return OK;