From bb490c00672f8f905f228391a42d71e2a2ef6aba Mon Sep 17 00:00:00 2001 From: Ashwin Natesan Date: Tue, 16 Aug 2022 16:26:52 +0530 Subject: [PATCH] mvc: Fix for int overflow when parsing u1_bits_in_frm_num Bug: 242555278 Test: fuzzer poc in bug Change-Id: Ie8b8c0a977ad827d7a05fd80b8d8186c78d2acb5 --- decoder/mvc/imvcd_nalu_parser.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/decoder/mvc/imvcd_nalu_parser.c b/decoder/mvc/imvcd_nalu_parser.c index 4e23d4b..2c6a572 100644 --- a/decoder/mvc/imvcd_nalu_parser.c +++ b/decoder/mvc/imvcd_nalu_parser.c @@ -166,14 +166,15 @@ static WORD32 imvcd_parse_subset_sps(mvc_dec_ctxt_t *ps_mvcd_ctxt, dec_bit_strea } } - ps_subset_sps->s_sps_data.u1_bits_in_frm_num = - 4 + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf); + u4_temp = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf); - if(ps_subset_sps->s_sps_data.u1_bits_in_frm_num > MAX_BITS_IN_FRAME_NUM) + if(u4_temp > (MAX_BITS_IN_FRAME_NUM - 4)) { return ERROR_INV_SPS_PPS_T; } + ps_subset_sps->s_sps_data.u1_bits_in_frm_num = 4 + u4_temp; + ps_subset_sps->s_sps_data.u2_u4_max_pic_num_minus1 = (1 << (ps_subset_sps->s_sps_data.u1_bits_in_frm_num)) - 1;