From 79dc65e02394a606b51970252579590436a926df Mon Sep 17 00:00:00 2001 From: Ashwin Natesan Date: Wed, 10 Aug 2022 11:35:21 +0530 Subject: [PATCH] mvc: Correct view id checks in SPS parsing Corrected checks for number of views and view id when parsing SPS in MVC decode Bug: 241865791 Bug: 241867454 Test: fuzzer poc in the bugs Change-Id: I8241de5c28ddbfebdb639852cf647df5e0a9487b --- decoder/mvc/imvcd_nalu_parser.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/decoder/mvc/imvcd_nalu_parser.c b/decoder/mvc/imvcd_nalu_parser.c index 02738e2..4e23d4b 100644 --- a/decoder/mvc/imvcd_nalu_parser.c +++ b/decoder/mvc/imvcd_nalu_parser.c @@ -50,6 +50,13 @@ static WORD32 imvcd_nalu_mvc_ext_parser(mvc_dec_ctxt_t *ps_mvcd_ctxt, dec_bit_st ps_nalu_mvc_ext->u1_non_idr_flag = ih264d_get_bit_h264(ps_bitstrm); ps_nalu_mvc_ext->u1_priority_id = ih264d_get_bits_h264(ps_bitstrm, 6); ps_nalu_mvc_ext->u2_view_id = ih264d_get_bits_h264(ps_bitstrm, 10); + + if((ps_nalu_mvc_ext->u2_view_id >= MAX_NUM_VIEWS) || + (ps_nalu_mvc_ext->u2_view_id >= ps_mvcd_ctxt->u2_num_views)) + { + return IVD_INVALID_BITSTREAM; + } + ps_nalu_mvc_ext->u1_temporal_id = ih264d_get_bits_h264(ps_bitstrm, 3); ps_nalu_mvc_ext->u1_anchor_pic_flag = ih264d_get_bit_h264(ps_bitstrm); ps_nalu_mvc_ext->u1_inter_view_flag = ih264d_get_bit_h264(ps_bitstrm); @@ -59,11 +66,6 @@ static WORD32 imvcd_nalu_mvc_ext_parser(mvc_dec_ctxt_t *ps_mvcd_ctxt, dec_bit_st return IVD_INVALID_BITSTREAM; } - if(ps_nalu_mvc_ext->u2_view_id >= MAX_NUM_VIEWS) - { - return IVD_INVALID_BITSTREAM; - } - return OK; } @@ -299,13 +301,14 @@ static WORD32 imvcd_parse_subset_sps(mvc_dec_ctxt_t *ps_mvcd_ctxt, dec_bit_strea } u2_num_views_m1 = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf); - ps_subset_sps->s_sps_mvc_ext.u2_num_views = 1 + u2_num_views_m1; - if(u2_num_views_m1 > MAX_NUM_VIEWS) + if(u2_num_views_m1 >= MAX_NUM_VIEWS) { return ERROR_INVALID_SEQ_PARAM; } + ps_subset_sps->s_sps_mvc_ext.u2_num_views = 1 + u2_num_views_m1; + if(ps_view_ctxt->i4_decode_header) { ps_mvcd_ctxt->u2_num_views = MAX(ps_mvcd_ctxt->u2_num_views, 1 + u2_num_views_m1);