commit b7bbfdb0275af183ac7c9d714b21cd2267578f3d
author Hamsalekha S <hamsalekha.s@ittiam.com> Fri Sep 08 14:22:22 2017 +0530
committer Nikoli Cartagena <dargeren@google.com> Tue Sep 19 12:04:19 2017 -0700
tree 35f0181e539a5bee4f4c6e294d2db7dee7403dec
parent 9736df600694130fda4c1c95231e1485d7ff7f97

Decoder: Updated error check while parsing num_ref_idx_lx_active.

Added an error check on the lower limit of u1_num_ref_idx_lx_active,
while parsing slice header. The minimum possible value is 1.

Bug: 64836894

Change-Id: I57056851fc135ed00f7a10af5c81eb560e9e12de
(cherry picked from commit 208c74d62a3e1039dc87818306e057877760fbaa)

decoder/ih264d_parse_bslice.c

diff --git a/decoder/ih264d_parse_bslice.c b/decoder/ih264d_parse_bslice.c
index 4418429..f087f8d 100644
--- a/decoder/ih264d_parse_bslice.c
+++ b/decoder/ih264d_parse_bslice.c
@@ -1399,7 +1399,8 @@
         {
             u1_max_ref_idx = MAX_FRAMES << 1;
         }
-        if((u4_temp > u1_max_ref_idx) || (ui_temp1 > u1_max_ref_idx))
+        if((u4_temp > u1_max_ref_idx) || (ui_temp1 > u1_max_ref_idx)
+                        || (u4_temp < 1) || (ui_temp1 < 1))
         {
             return ERROR_NUM_REF;
         }

decoder/ih264d_parse_pslice.c

diff --git a/decoder/ih264d_parse_pslice.c b/decoder/ih264d_parse_pslice.c
index d6b0f23..9b9256b 100644
--- a/decoder/ih264d_parse_pslice.c
+++ b/decoder/ih264d_parse_pslice.c
@@ -1961,7 +1961,7 @@
 
 
         UWORD8 u1_max_ref_idx = MAX_FRAMES << u1_field_pic_flag;
-        if(u4_temp > u1_max_ref_idx)
+        if(u4_temp > u1_max_ref_idx || u4_temp < 1)
         {
             return ERROR_NUM_REF;
         }