Merge "Decoder: Add error check for expected_poc in ih264d_decode_pic_order_cnt" into qt-dev

am: 6db97fcc8d

Change-Id: I3b6cbf44cc70645356be2b8869cf57ed32c7a445

decoder/ih264d_defs.h

@@ -34,6 +34,8 @@
  *
  ************************************************************************
  */
+#include <stdint.h>
+
 #define H264_MAX_FRAME_WIDTH                4080
 #define H264_MAX_FRAME_HEIGHT               4080
 #define H264_MAX_FRAME_SIZE                 (4096 * 2048)
@@ -47,6 +49,9 @@
 #define CHECKBIT(a,i) ((a) &  (1 << i))
 #define CLEARBIT(a,i) ((a) &= ~(1 << i))
 
+/** Macro to check if a number lies in the valid integer range */
+#define IS_OUT_OF_RANGE_S32(a) (((a) < INT32_MIN) || ((a) > INT32_MAX))
+
 /** Macro to convert a integer to a boolean value */
 #define BOOLEAN(x) (!!(x))
 

decoder/ih264d_error_handler.h

@@ -113,7 +113,8 @@ typedef enum
     ERROR_IN_LAST_SLICE_OF_PIC = 0x93,
     ERROR_NEW_FRAME_EXPECTED = 0x94,
     ERROR_INCOMPLETE_FRAME = 0x95,
-    ERROR_VUI_PARAMS_NOT_FOUND = 0x96
+    ERROR_VUI_PARAMS_NOT_FOUND = 0x96,
+    ERROR_INV_POC = 0x97
 
 } h264_decoder_error_code_t;
 

decoder/ih264d_utils.c

@@ -313,36 +313,62 @@ WORD32 ih264d_decode_pic_order_cnt(UWORD8 u1_is_idr_slice,
                                     + ps_seq->i4_ofst_for_ref_frame[i];
                 }
 
-                expected_poc =(WORD32)CLIP_S32(i8_result);
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+
+                expected_poc = (WORD32)i8_result;
+
             }
             else
                 expected_poc = 0;
 
             if(u1_nal_ref_idc == 0)
             {
-                expected_poc = expected_poc
+                i8_result = expected_poc
                                 + ps_seq->i4_ofst_for_non_ref_pic;
+
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+
+                expected_poc = (WORD32)i8_result;
             }
 
             /* 6. TopFieldOrderCnt or BottomFieldOrderCnt are derived as */
             if(!u1_field_pic_flag)
             {
-                i4_top_field_order_cnt = expected_poc
+                i8_result = expected_poc
                                 + ps_cur_poc->i4_delta_pic_order_cnt[0];
-                i4_bottom_field_order_cnt = i4_top_field_order_cnt
+
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+                i4_top_field_order_cnt = (WORD32)i8_result;
+
+                i8_result = i4_top_field_order_cnt
                                 + ps_seq->i4_ofst_for_top_to_bottom_field
                                 + ps_cur_poc->i4_delta_pic_order_cnt[1];
+
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+                i4_bottom_field_order_cnt = (WORD32)i8_result;
             }
             else if(!u1_bottom_field_flag)
             {
-                i4_top_field_order_cnt = expected_poc
+                i8_result = expected_poc
                                 + ps_cur_poc->i4_delta_pic_order_cnt[0];
+
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+                i4_top_field_order_cnt = (WORD32)i8_result;
             }
             else
             {
-                i4_bottom_field_order_cnt = expected_poc
+                i8_result = expected_poc
                                 + ps_seq->i4_ofst_for_top_to_bottom_field
                                 + ps_cur_poc->i4_delta_pic_order_cnt[0];
+
+                if(IS_OUT_OF_RANGE_S32(i8_result))
+                    return ERROR_INV_POC;
+                i4_bottom_field_order_cnt = (WORD32)i8_result;
             }
             /* Copy the current POC info into Previous POC structure */
             ps_cur_poc->i4_prev_frame_num_ofst = frame_num_ofst;