commit fe5931df37ed602c7901aef285ef96def27c7e1f
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Fri Jan 13 11:23:29 2017 +0530
committer gitbuildkicker <android-build@google.com> Mon Jan 23 11:22:47 2017 -0800
tree db4130c4f449d238d76b73743b5d0ac0622b1f4a
parent d11f398fd4c3be9b6cc288f8ead1f1149fb65aa2

Decoder: Fixed an out of bound access while parsing SEI

Invalid SPS Id read was resulting in an out of bound read
Bug: 33552073
Change-Id: Ie5b80222fc7ac3a64475340371be0facdf999d7b

(cherry picked from commit d3d60c6a5d7ab605d19b9ac4b95bc227b7b870dc)
(cherry picked from commit 99a85bb4690dd30871d9457c30ca3b44a0928cc1)

decoder/ih264d_sei.c

diff --git a/decoder/ih264d_sei.c b/decoder/ih264d_sei.c
index 14ffcd6..800f2c9 100644
--- a/decoder/ih264d_sei.c
+++ b/decoder/ih264d_sei.c
@@ -80,7 +80,7 @@
     UNUSED(ps_buf_prd);
     u1_seq_parameter_set_id = ih264d_uev(pu4_bitstrm_ofst,
                                          pu4_bitstrm_buf);
-    if(u1_seq_parameter_set_id > MAX_NUM_SEQ_PARAMS)
+    if(u1_seq_parameter_set_id >= MAX_NUM_SEQ_PARAMS)
         return ERROR_INVALID_SEQ_PARAM;
     ps_seq = &ps_dec->ps_sps[u1_seq_parameter_set_id];
     if(TRUE != ps_seq->u1_is_valid)