commit 3226a3784f01eddbca8bb91511f2add204960733
author Naveen Kumar P <naveenkumar.p@ittiam.com> Fri Apr 13 13:55:43 2018 +0530
committer hamzeh <hamzeh@google.com> Wed May 16 20:25:26 2018 -0700
tree b81a9e37599ad5ef4e123c8f1382a332bdaf3af1
parent 3469e55c96674e562457afb0750036aeffcf51bf

Return error for invalid st/lt sps parameters

When num_short_term_ref_pic_sets or num_long_term_ref_pics_sps in
sps is out of range, error is returned.

Bug: 77599438
Test: poc before/after
Change-Id: I652d27849438c3ea2d42fc6e9abb8aeb25ebdc22
(cherry picked from commit b93923e2883a2d1a4eb46290c3b15a84da808d66)

common/ihevc_defs.h

diff --git a/common/ihevc_defs.h b/common/ihevc_defs.h
index 13b0239..1878f30 100644
--- a/common/ihevc_defs.h
+++ b/common/ihevc_defs.h
@@ -313,7 +313,7 @@
 #define SPS_MAX_SUB_LAYERS  7
 
 /* Maximum long term reference pics */
-#define MAX_LTREF_PICS_SPS 16
+#define MAX_LTREF_PICS_SPS 32
 
 #define MAX_STREF_PICS_SPS 64
 

decoder/ihevcd_parse_headers.c

diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index c3a7cf0..54177d9 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1559,10 +1559,12 @@
 
     }
     UEV_PARSE("num_short_term_ref_pic_sets", value, ps_bitstrm);
+    if(value < 0 || value > MAX_STREF_PICS_SPS)
+    {
+        return IHEVCD_INVALID_PARAMETER;
+    }
     ps_sps->i1_num_short_term_ref_pic_sets = value;
 
-    ps_sps->i1_num_short_term_ref_pic_sets = CLIP3(ps_sps->i1_num_short_term_ref_pic_sets, 0, MAX_STREF_PICS_SPS);
-
     for(i = 0; i < ps_sps->i1_num_short_term_ref_pic_sets; i++)
         ihevcd_short_term_ref_pic_set(ps_bitstrm, &ps_sps->as_stref_picset[0], ps_sps->i1_num_short_term_ref_pic_sets, i, &ps_sps->as_stref_picset[i]);
 
@@ -1572,6 +1574,10 @@
     if(ps_sps->i1_long_term_ref_pics_present_flag)
     {
         UEV_PARSE("num_long_term_ref_pics_sps", value, ps_bitstrm);
+        if(value < 0 || value > MAX_LTREF_PICS_SPS)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
         ps_sps->i1_num_long_term_ref_pics_sps = value;
 
         for(i = 0; i < ps_sps->i1_num_long_term_ref_pics_sps; i++)