From 4286d31e9e121e1005ad8986bcbf9ba3f62122ee Mon Sep 17 00:00:00 2001 From: Naveen Kumar P Date: Wed, 17 May 2017 14:15:44 +0530 Subject: [PATCH] Return error for invalid reorder parameter Bug: 62689208 Test: before/after process PoC on ASAN builds. Change-Id: Ib1404bdf512fba28c2641f3f2022811a2a2d7751 --- decoder/ihevcd_parse_headers.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c index 5671524..8bc5940 100644 --- a/decoder/ihevcd_parse_headers.c +++ b/decoder/ihevcd_parse_headers.c @@ -1343,20 +1343,18 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) for(; i < ps_sps->i1_sps_max_sub_layers; i++) { UEV_PARSE("max_dec_pic_buffering", value, ps_bitstrm); + if((value + 1) > MAX_DPB_SIZE) + { + return IHEVCD_INVALID_PARAMETER; + } ps_sps->ai1_sps_max_dec_pic_buffering[i] = value + 1; - if(ps_sps->ai1_sps_max_dec_pic_buffering[i] > MAX_DPB_SIZE) - { - return IHEVCD_INVALID_PARAMETER; - } - UEV_PARSE("num_reorder_pics", value, ps_bitstrm); - ps_sps->ai1_sps_max_num_reorder_pics[i] = value; - - if(ps_sps->ai1_sps_max_num_reorder_pics[i] > ps_sps->ai1_sps_max_dec_pic_buffering[i]) + if(value > ps_sps->ai1_sps_max_dec_pic_buffering[i]) { return IHEVCD_INVALID_PARAMETER; } + ps_sps->ai1_sps_max_num_reorder_pics[i] = value; UEV_PARSE("max_latency_increase", value, ps_bitstrm); ps_sps->ai1_sps_max_latency_increase[i] = value;