wrapper/libavc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "mvc: Fix for int overflow when parsing u1_bits_in_frm_num"

Browse source
This commit is contained in:
Treehugger Robot 2022-08-19 07:46:59 +00:00 • committed by Gerrit Code Review
commit c5ee6f9883
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
decoder/mvc/imvcd_nalu_parser.c
View file

@ -194,14 +194,15 @@ static WORD32 imvcd_parse_subset_sps(mvc_dec_ctxt_t *ps_mvcd_ctxt, dec_bit_strea
}
}
ps_subset_sps->s_sps_data.u1_bits_in_frm_num =
4 + ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
u4_temp = ih264d_uev(pu4_bitstrm_ofst, pu4_bitstrm_buf);
if(ps_subset_sps->s_sps_data.u1_bits_in_frm_num > MAX_BITS_IN_FRAME_NUM)
if(u4_temp > (MAX_BITS_IN_FRAME_NUM - 4))
{
return ERROR_INV_SPS_PPS_T;
}
ps_subset_sps->s_sps_data.u1_bits_in_frm_num = 4 + u4_temp;
ps_subset_sps->s_sps_data.u2_u4_max_pic_num_minus1 =
(1 << (ps_subset_sps->s_sps_data.u1_bits_in_frm_num)) - 1;