commit 208eb8ff46694b900bb174f72b4263bd91e660d9
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Tue Feb 14 22:01:28 2017 +0000
committer android-build-merger <android-build-merger@google.com> Tue Feb 14 22:01:28 2017 +0000
tree aab7248521a0d38833b914bde68e720daba62216
parent e82a918b66c22ca267db9e72aceacbd9161199c1
parent 70da218a8e528c952bb0c1416ff92110ef441405

Handle invalid num_reorder_pics & max_dec_pic_buffering in SPS am: 1ab5ce7e42 am: cb6fa6a0d4 am: f5674af080 am: b3169d93df am: 0c49980418 am: 4b4a16e22a am: 93b2398b29 am: a5596a2b1d am: dba11e3fa8 am: 157125847b
am: 70da218a8e

Change-Id: Ib68bd61199d77b97da228566cb98e12859777498

decoder/ihevcd_parse_headers.c

diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index 0782274..ba433aa 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1392,9 +1392,19 @@
         UEV_PARSE("max_dec_pic_buffering", value, ps_bitstrm);
         ps_sps->ai1_sps_max_dec_pic_buffering[i] = value + 1;
 
+        if(ps_sps->ai1_sps_max_dec_pic_buffering[i] > MAX_DPB_SIZE)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
+
         UEV_PARSE("num_reorder_pics", value, ps_bitstrm);
         ps_sps->ai1_sps_max_num_reorder_pics[i] = value;
 
+        if(ps_sps->ai1_sps_max_num_reorder_pics[i] > ps_sps->ai1_sps_max_dec_pic_buffering[i])
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
+
         UEV_PARSE("max_latency_increase", value, ps_bitstrm);
         ps_sps->ai1_sps_max_latency_increase[i] = value;
     }