commit 35b381156a6117017b5f9bbf2d3a6c1473a6bc56
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Fri Jun 16 15:37:48 2017 +0530
committer android-build-team Robot <android-build-team-robot@google.com> Wed Oct 04 18:07:35 2017 +0000
tree 8c0c71a2db4d8e93fea1ac0714910ea1021f5519
parent e31af2ccf7be68792c6272105012f3748b8c10ad

Added an out of bound check on u4_num_bufs in input argument

ps_dec_ip->s_out_buffer.u4_num_bufs was missing out of bound checks

Bug: 62688399
Change-Id: Ic5e5c002d29fcb18064550d5a5f9289bb68b448e
(cherry picked from commit aa11ab9fdbb63766703a6280f4fc778f2f2c91ed)

decoder/ih264d_api.c

diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index 2fccb10..0341389 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -1804,7 +1804,8 @@
                     && ps_dec->i4_decode_header == 0)
     {
         UWORD32 i;
-        if(ps_dec->ps_out_buffer->u4_num_bufs == 0)
+        if((ps_dec->ps_out_buffer->u4_num_bufs == 0) ||
+           (ps_dec->ps_out_buffer->u4_num_bufs > IVD_VIDDEC_MAX_IO_BUFFERS))
         {
             ps_dec_op->u4_error_code |= 1 << IVD_UNSUPPORTEDPARAM;
             ps_dec_op->u4_error_code |= IVD_DISP_FRM_ZERO_OP_BUFS;