Handle invalid num_reorder_pics & max_dec_pic_buffering in SPS
Bug: 33864300
Change-Id: I920e45c3420a1a41a366ad45bd4186c5f6af6d6b
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index 00fc9cb..29af673 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1321,9 +1321,19 @@
UEV_PARSE("max_dec_pic_buffering", value, ps_bitstrm);
ps_sps->ai1_sps_max_dec_pic_buffering[i] = value + 1;
+ if(ps_sps->ai1_sps_max_dec_pic_buffering[i] > MAX_DPB_SIZE)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+
UEV_PARSE("num_reorder_pics", value, ps_bitstrm);
ps_sps->ai1_sps_max_num_reorder_pics[i] = value;
+ if(ps_sps->ai1_sps_max_num_reorder_pics[i] > ps_sps->ai1_sps_max_dec_pic_buffering[i])
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+
UEV_PARSE("max_latency_increase", value, ps_bitstrm);
ps_sps->ai1_sps_max_latency_increase[i] = value;
}