From 1ab5ce7e42feccd49e49752e6f58f9097ac5d254 Mon Sep 17 00:00:00 2001 From: Harish Mahendrakar Date: Fri, 13 Jan 2017 17:46:11 +0530 Subject: [PATCH] Handle invalid num_reorder_pics & max_dec_pic_buffering in SPS Bug: 33864300 Change-Id: I920e45c3420a1a41a366ad45bd4186c5f6af6d6b --- decoder/ihevcd_parse_headers.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c index 00fc9cb..29af673 100644 --- a/decoder/ihevcd_parse_headers.c +++ b/decoder/ihevcd_parse_headers.c @@ -1321,9 +1321,19 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) UEV_PARSE("max_dec_pic_buffering", value, ps_bitstrm); ps_sps->ai1_sps_max_dec_pic_buffering[i] = value + 1; + if(ps_sps->ai1_sps_max_dec_pic_buffering[i] > MAX_DPB_SIZE) + { + return IHEVCD_INVALID_PARAMETER; + } + UEV_PARSE("num_reorder_pics", value, ps_bitstrm); ps_sps->ai1_sps_max_num_reorder_pics[i] = value; + if(ps_sps->ai1_sps_max_num_reorder_pics[i] > ps_sps->ai1_sps_max_dec_pic_buffering[i]) + { + return IHEVCD_INVALID_PARAMETER; + } + UEV_PARSE("max_latency_increase", value, ps_bitstrm); ps_sps->ai1_sps_max_latency_increase[i] = value; }