commit 07e3891df5e342278fe15a4a7b3ae9e5effcf474
author Hamsalekha S <hamsalekha.s@ittiam.com> Tue Jul 04 17:06:50 2017 +0530
committer Nikoli Cartagena <dargeren@google.com> Mon Nov 13 17:12:15 2017 -0800
tree d0dd17138e59605c48500b32b6a61e9a719a5833
parent 52e6bb529761ddf96a584539b43117cc68dfd082

Decoder: Increased allocation and added checks in sei parsing.

This prevents heap overflow while parsing sei_message.

Bug: 63122634
Test: ran PoC on unpatched/patched
Change-Id: I61c1ff4ac053a060be8c24da4671db985cac628c
(cherry picked from commit f2b70d353768af8d4ead7f32497be05f197925ef)

decoder/ih264d_api.c

diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index 5ef49b1..5f306c2 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -2044,7 +2044,8 @@
             void *pv_buf;
             void *pv_mem_ctxt = ps_dec->pv_mem_ctxt;
             size = MAX(256000, ps_dec->u2_pic_wd * ps_dec->u2_pic_ht * 3 / 2);
-            pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128, size);
+            pv_buf = ps_dec->pf_aligned_alloc(pv_mem_ctxt, 128,
+                                              size + EXTRA_BS_OFFSET);
             RETURN_IF((NULL == pv_buf), IV_FAIL);
             ps_dec->pu1_bits_buf_dynamic = pv_buf;
             ps_dec->u4_dynamic_bits_buf_size = size;

decoder/ih264d_defs.h

diff --git a/decoder/ih264d_defs.h b/decoder/ih264d_defs.h
index 0682339..d6e3029 100644
--- a/decoder/ih264d_defs.h
+++ b/decoder/ih264d_defs.h
@@ -107,6 +107,9 @@
 /* For 420SP */
 #define YUV420SP_FACTOR 2
 
+/*To prevent buffer overflow access; in case the size of nal unit is
+ *  greater than the allocated buffer size*/
+#define EXTRA_BS_OFFSET 16*16*2
 
 /**
  ***************************************************************************

decoder/ih264d_sei.c

diff --git a/decoder/ih264d_sei.c b/decoder/ih264d_sei.c
index 800f2c9..098a1f3 100644
--- a/decoder/ih264d_sei.c
+++ b/decoder/ih264d_sei.c
@@ -336,7 +336,7 @@
         ui4_payload_type = 0;
 
         u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8);
-        while(0xff == u4_bits)
+        while(0xff == u4_bits && !EXCEED_OFFSET(ps_bitstrm))
         {
             u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8);
             ui4_payload_type += 255;
@@ -345,7 +345,7 @@
 
         ui4_payload_size = 0;
         u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8);
-        while(0xff == u4_bits)
+        while(0xff == u4_bits && !EXCEED_OFFSET(ps_bitstrm))
         {
             u4_bits = ih264d_get_bits_h264(ps_bitstrm, 8);
             ui4_payload_size += 255;
@@ -370,7 +370,8 @@
             {
                 H264_DEC_DEBUG_PRINT("\nError in parsing SEI message");
             }
-            while(0 == ih264d_check_byte_aligned(ps_bitstrm))
+            while(0 == ih264d_check_byte_aligned(ps_bitstrm)
+                            && !EXCEED_OFFSET(ps_bitstrm))
             {
                 u4_bits = ih264d_get_bit_h264(ps_bitstrm);
                 if(u4_bits)