wrapper/libhevc-mirror
1
0
Fork 0
mirror of https://github.com/ittiam-systems/libhevc.git synced 2026-08-15 15:22:36 +07:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge "decoder: Fix integer overflow while parsing num_long_term_pics" into qt-qpr1-dev

Browse source
This commit is contained in:
TreeHugger Robot 2020-03-20 02:31:08 +00:00 • committed by Android (Google) Code Review
commit 1e1b2c7f1e
1 changed files with 6 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
decoder/ihevcd_parse_slice_header.c
View file

@ -471,7 +471,8 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec,
ps_slice_hdr->i1_num_long_term_sps = value;
}
UEV_PARSE("num_long_term_pics", value, ps_bitstrm);
if((value + ps_slice_hdr->i1_num_long_term_sps + num_neg_pics + num_pos_pics) > (MAX_DPB_SIZE - 1))
if(((ULWORD64)value + ps_slice_hdr->i1_num_long_term_sps + num_neg_pics +
num_pos_pics) > (MAX_DPB_SIZE - 1))
{
return IHEVCD_INVALID_PARAMETER;
}
@ -487,6 +488,10 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec,
{
WORD32 num_bits = 32 - CLZ(ps_sps->i1_num_long_term_ref_pics_sps - 1);
BITS_PARSE("lt_idx_sps[ i ]", value, ps_bitstrm, num_bits);
if(value >= ps_sps->i1_num_long_term_ref_pics_sps)
{
return IHEVCD_INVALID_PARAMETER;
}
}
else
{