commit 196e72450a1f01797c7f994d00752649407a8baa
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Thu Aug 22 16:54:56 2019 -0700
committer Ray Essick <essick@google.com> Tue Feb 04 05:09:05 2020 +0000
tree 8729d9bb2973660e5ece9c9c982ba3bbef6f9e73
parent 75d1ac1026539f82a299ef6cea2b59150098ddbb

Fix DoS in NAL search

Bug: 139939283
Test: poc in bug
Change-Id: I345232790e2d351d82e9dc6973a5ef86ce513ef3
(cherry picked from commit e52410163e4829a94b7f11ee65fbb5db0d956e21)

decoder/ihevcd_decode.c

diff --git a/decoder/ihevcd_decode.c b/decoder/ihevcd_decode.c
index 16ed36b..9f634b7 100644
--- a/decoder/ihevcd_decode.c
+++ b/decoder/ihevcd_decode.c
@@ -626,6 +626,13 @@
 
         nal_ofst = ihevcd_nal_search_start_code(ps_codec->pu1_inp_bitsbuf,
                                                 ps_codec->i4_bytes_remaining);
+        /* If there is no start code found, consume the data and break */
+        if(nal_ofst == ps_codec->i4_bytes_remaining)
+        {
+            ps_codec->pu1_inp_bitsbuf += nal_ofst;
+            ps_codec->i4_bytes_remaining -= nal_ofst;
+            break;
+        }
 
         ps_codec->i4_nal_ofst = nal_ofst;
         {