Added check for invalid log2_max_transform_block_size in SPS
Bug: 33918236
Bug: 33964497
Bug: 33965905
Bug: 33862021
Change-Id: If121221d0f6e983c05d95d123af9bed378d1961f
(cherry picked from commit b5cae8181efbb9649ffddb659305a0da59ed445a)
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index 04d22d8..ec3d193 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1193,6 +1193,7 @@
sps_t *ps_sps;
profile_tier_lvl_info_t s_ptl;
bitstrm_t *ps_bitstrm = &ps_codec->s_parse.s_bitstrm;
+ WORD32 ctb_log2_size_y = 0;
BITS_PARSE("video_parameter_set_id", value, ps_bitstrm, 4);
@@ -1325,6 +1326,8 @@
UEV_PARSE("log2_diff_max_min_coding_block_size", value, ps_bitstrm);
ps_sps->i1_log2_diff_max_min_coding_block_size = value;
+ ctb_log2_size_y = ps_sps->i1_log2_min_coding_block_size + ps_sps->i1_log2_diff_max_min_coding_block_size;
+
UEV_PARSE("log2_min_transform_block_size_minus2", value, ps_bitstrm);
ps_sps->i1_log2_min_transform_block_size = value + 2;
@@ -1334,6 +1337,12 @@
ps_sps->i1_log2_max_transform_block_size = ps_sps->i1_log2_min_transform_block_size +
ps_sps->i1_log2_diff_max_min_transform_block_size;
+ if ((ps_sps->i1_log2_max_transform_block_size < 0) ||
+ (ps_sps->i1_log2_max_transform_block_size > MIN(ctb_log2_size_y, 5)))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
+
ps_sps->i1_log2_ctb_size = ps_sps->i1_log2_min_coding_block_size +
ps_sps->i1_log2_diff_max_min_coding_block_size;