wrapper/libhevc-mirror
1
0
Fork 0
mirror of https://github.com/ittiam-systems/libhevc.git synced 2026-08-15 15:22:36 +07:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge "Check for buffer overflow in pps/slice header parsing" into lmp-dev am: 1853d3871a

Browse source 
am: f7635dd278

Change-Id: I9cda2fdea6bec9cfb501120f8d30b97c80be9bb8
This commit is contained in:
Naveen Kumar P 2017-05-16 22:26:59 +00:00 • committed by android-build-merger
commit 17caa64f8b
2 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
decoder/ihevcd_parse_headers.c
View file

@ -1932,6 +1932,9 @@ IHEVCD_ERROR_T ihevcd_parse_pps(codec_t *ps_codec)
/* Not present in HM */
BITS_PARSE("pps_extension_flag", value, ps_bitstrm, 1);
if((UWORD8 *)ps_bitstrm->pu4_buf > ps_bitstrm->pu1_buf_max)
return IHEVCD_INVALID_PARAMETER;
ps_codec->i4_pps_done = 1;
return ret;
}

3
decoder/ihevcd_parse_slice_header.c
View file

@ -859,6 +859,9 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec,
ihevcd_bits_flush_to_byte_boundary(ps_bitstrm);
if((UWORD8 *)ps_bitstrm->pu4_buf > ps_bitstrm->pu1_buf_max)
return IHEVCD_INVALID_PARAMETER;
{
dpb_mgr_t *ps_dpb_mgr = (dpb_mgr_t *)ps_codec->pv_dpb_mgr;
WORD32 r_idx;