wrapper/libavc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

mvc: Fix for int overflow when parsing u1_bits_in_frm_num

Browse source 
Bug: 242555278
Test: fuzzer poc in bug
Change-Id: Ie8b8c0a977ad827d7a05fd80b8d8186c78d2acb5
This commit is contained in:
Ashwin Natesan 2022-08-16 16:26:52 +05:30
parent 5d36aabe47
commit bb490c0067
No known key found for this signature in database
GPG key ID: F9C8103B9094CF1A
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
decoder/mvc/imvcd_nalu_parser.c
View file

@ -166,14 +166,15 @@ static WORD32 imvcd_parse_subset_sps(mvc_dec_ctxt_t *ps_mvcd_ctxt, dec_bit_strea
}
}
ps_subset_sps->s_sps_data.u1_bits_in_frm_num =
4 + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
u4_temp = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
if(ps_subset_sps->s_sps_data.u1_bits_in_frm_num > MAX_BITS_IN_FRAME_NUM)
if(u4_temp > (MAX_BITS_IN_FRAME_NUM - 4))
{
return ERROR_INV_SPS_PPS_T;
}
ps_subset_sps->s_sps_data.u1_bits_in_frm_num = 4 + u4_temp;
ps_subset_sps->s_sps_data.u2_u4_max_pic_num_minus1 =
(1 << (ps_subset_sps->s_sps_data.u1_bits_in_frm_num)) - 1;