Merge "Fix OOB issue in nal unit parsing" into lmp-dev am: 1ce65aea9f am: c1451ed95b

am: 18a325cf80

Change-Id: I83294b270ac8f6853dce67076b497d2744aed571
This commit is contained in:
Naveen Kumar P 2017-06-06 20:54:48 +00:00 committed by android-build-merger
commit f9a3d7de57

View file

@ -114,7 +114,8 @@ WORD32 ihevcd_nal_search_start_code(UWORD8 *pu1_buf, WORD32 bytes_remaining)
}
zero_byte_cnt++;
if((pu1_buf[ofst + 1] == START_CODE_PREFIX_BYTE) &&
if((ofst < (bytes_remaining - 1)) &&
(pu1_buf[ofst + 1] == START_CODE_PREFIX_BYTE) &&
(zero_byte_cnt >= NUM_ZEROS_BEFORE_START_CODE))
{
/* Found the start code */
@ -123,7 +124,7 @@ WORD32 ihevcd_nal_search_start_code(UWORD8 *pu1_buf, WORD32 bytes_remaining)
break;
}
}
if(0 == start_code_found)
if((0 == start_code_found) && (ofst < bytes_remaining))
{
if((START_CODE_PREFIX_BYTE == pu1_buf[ofst]) &&
(zero_byte_cnt >= NUM_ZEROS_BEFORE_START_CODE))
@ -231,7 +232,7 @@ IHEVCD_ERROR_T ihevcd_nal_remv_emuln_bytes(UWORD8 *pu1_src,
}
if(0 == start_code_found)
if((0 == start_code_found) && (src_cnt < bytes_remaining))
{
u1_src = pu1_src[src_cnt++];
if(zero_byte_cnt >= NUM_ZEROS_BEFORE_START_CODE)