Merge "Decoder: Updated error check while parsing num_ref_idx_lx_active." into mnc-dev am: 224824ba17 am: 628056c0ed am: becbdb15b7 am: 2f85a749c5 am: bd6a74b45b am: 828dc44ed5 am: a1d4d39a61 am: b4f8a983ad am: d3ea876a4d am: 957708e9b1

am: 0c909b99f0

Change-Id: I165748de0043150efcc1ef29779e726c856fba00
This commit is contained in:
Marco Nelissen 2017-09-14 01:19:50 +00:00 committed by android-build-merger
commit bd336ce65e
2 changed files with 3 additions and 2 deletions

View file

@ -1399,7 +1399,8 @@ WORD32 ih264d_parse_bslice(dec_struct_t * ps_dec, UWORD16 u2_first_mb_in_slice)
{ {
u1_max_ref_idx = MAX_FRAMES << 1; u1_max_ref_idx = MAX_FRAMES << 1;
} }
if((u4_temp > u1_max_ref_idx) || (ui_temp1 > u1_max_ref_idx)) if((u4_temp > u1_max_ref_idx) || (ui_temp1 > u1_max_ref_idx)
|| (u4_temp < 1) || (ui_temp1 < 1))
{ {
return ERROR_NUM_REF; return ERROR_NUM_REF;
} }

View file

@ -1961,7 +1961,7 @@ WORD32 ih264d_parse_pslice(dec_struct_t *ps_dec, UWORD16 u2_first_mb_in_slice)
UWORD8 u1_max_ref_idx = MAX_FRAMES << u1_field_pic_flag; UWORD8 u1_max_ref_idx = MAX_FRAMES << u1_field_pic_flag;
if(u4_temp > u1_max_ref_idx) if(u4_temp > u1_max_ref_idx || u4_temp < 1)
{ {
return ERROR_NUM_REF; return ERROR_NUM_REF;
} }