From 5aee2541810f19aec67a1a9ea64973eb557aae9c Mon Sep 17 00:00:00 2001 From: Naveen Kumar P Date: Fri, 1 Sep 2017 06:54:36 -0700 Subject: [PATCH] RESTRICT AUTOMERGE Fix heap buffer overflow Test: - Push multi_rec.hevc (in the bug thread) to the device - Build: mmm external/libhevc - Run on device: hevcdec --input multi_res.hevc --num_frames -1 --num_cores 2 Bug: 62815506 Merged-In: I7e0828c9a9bb1e9997c379544ea5f4eb3556417d Change-Id: I7e0828c9a9bb1e9997c379544ea5f4eb3556417d --- decoder/ihevcd_parse_headers.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c index 506054b..cf1df16 100644 --- a/decoder/ihevcd_parse_headers.c +++ b/decoder/ihevcd_parse_headers.c @@ -1534,10 +1534,14 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) ps_sps->i2_pic_ht_in_min_cb = numerator / (1 << ps_sps->i1_log2_min_coding_block_size); } - if((0 != ps_codec->i4_first_pic_done) && + if((0 != ps_codec->i4_sps_done) && ((ps_codec->i4_wd != ps_sps->i2_pic_width_in_luma_samples) || (ps_codec->i4_ht != ps_sps->i2_pic_height_in_luma_samples))) { + if(0 == ps_codec->i4_first_pic_done) + { + return IHEVCD_INVALID_PARAMETER; + } ps_codec->i4_reset_flag = 1; return (IHEVCD_ERROR_T)IVD_RES_CHANGED; }