wrapper/libhevc-mirror
1
0
Fork 0
mirror of https://github.com/ittiam-systems/libhevc.git synced 2026-08-15 15:22:36 +07:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge "Check for buffer overflow in pps/slice header parsing" into lmp-dev am: 1853d3871a am: f7635dd278 am: 17caa64f8b

Browse source 
am: 0b13008b9a

Change-Id: Iff756412d3aae6cebffffde91c2577872e35813a
This commit is contained in:
Naveen Kumar P 2017-05-16 22:33:32 +00:00 • committed by android-build-merger
commit 76c466f238
2 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
decoder/ihevcd_parse_headers.c
View file

@ -1972,6 +1972,9 @@ IHEVCD_ERROR_T ihevcd_parse_pps(codec_t *ps_codec)
/* Not present in HM */
BITS_PARSE("pps_extension_flag", value, ps_bitstrm, 1);
if((UWORD8 *)ps_bitstrm->pu4_buf > ps_bitstrm->pu1_buf_max)
return IHEVCD_INVALID_PARAMETER;
ps_codec->i4_pps_done = 1;
return ret;
}

3
decoder/ihevcd_parse_slice_header.c
View file

@ -862,6 +862,9 @@ IHEVCD_ERROR_T ihevcd_parse_slice_header(codec_t *ps_codec,
ihevcd_bits_flush_to_byte_boundary(ps_bitstrm);
if((UWORD8 *)ps_bitstrm->pu4_buf > ps_bitstrm->pu1_buf_max)
return IHEVCD_INVALID_PARAMETER;
{
dpb_mgr_t *ps_dpb_mgr = (dpb_mgr_t *)ps_codec->pv_dpb_mgr;
WORD32 r_idx;