commit f26ce50eebd6e11173687aca2e0225505f2904a0
author Hamsalekha S <hamsalekha.s@ittiam.com> Wed May 10 14:23:48 2017 +0530
committer JP Sugarbroad <jpsugar@google.com> Thu May 25 14:05:05 2017 -0700
tree 0780d7823ef47c77f1d2f0d76cc4d3169ffb356d
parent ead7ee92372b51730655287954c96b9bf5c42d3a

Decoder: Added an error check while parsing PPS.

Added an error check while parsing PPS syntax element
second_chroma_qp_index_offset.

Bug: 37207120

Change-Id: Icba6b7bcf5940505717ee61134ed801c221b6e26
(cherry picked from commit 62f98981ffc29082dd4bbf173a043a5bcbb86652)

decoder/ih264d_parse_headers.c

diff --git a/decoder/ih264d_parse_headers.c b/decoder/ih264d_parse_headers.c
index 0bc4c3f..3807a14 100644
--- a/decoder/ih264d_parse_headers.c
+++ b/decoder/ih264d_parse_headers.c
@@ -361,11 +361,13 @@
         }
 
         /* read second_chroma_qp_index_offset syntax element */
-        ps_pps->i1_second_chroma_qp_index_offset = ih264d_sev(
+        i_temp = ih264d_sev(
                         pu4_bitstrm_ofst, pu4_bitstrm_buf);
 
-        if((ps_pps->i1_second_chroma_qp_index_offset + 12) > 24)
+        if((i_temp < -12) || (i_temp > 12))
             return ERROR_INV_RANGE_QP_T;
+
+        ps_pps->i1_second_chroma_qp_index_offset = i_temp;
     }
 
     /* In case bitstream read has exceeded the filled size, then