commit 59ed59ec9d0d9acedc61eb7ea73f1162c7c22ad2
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Mon May 15 18:51:18 2017 +0530
committer android-build-team Robot <android-build-team-robot@google.com> Wed May 24 22:48:11 2017 +0000
tree f5c0f9381ae9b03908798a66a2d0bb060650bf7c
parent ac09a1bada1eff2ec7fd6de470743497ead8bb43

Fix heap buffer overflow while searching for valid PPS

Bug: 37094889
Test: Tested POC on ASAN build
Change-Id: Id4e52cd10a4d5eac015efe4b752162dc39cc30b8
(cherry picked from commit 520465122804c4022edd0c8c3c54a93fb4cba613)

decoder/ihevcd_parse_slice_header.c

diff --git a/decoder/ihevcd_parse_slice_header.c b/decoder/ihevcd_parse_slice_header.c
index a68db25..e1b50b7 100644
--- a/decoder/ihevcd_parse_slice_header.c
+++ b/decoder/ihevcd_parse_slice_header.c
@@ -257,10 +257,11 @@
     {
         pps_t *ps_pps_ref = ps_codec->ps_pps_base;
         while(0 == ps_pps_ref->i1_pps_valid)
+        {
             ps_pps_ref++;
-
-        if((ps_pps_ref - ps_codec->ps_pps_base >= MAX_PPS_CNT - 1))
-            return IHEVCD_INVALID_HEADER;
+            if((ps_pps_ref - ps_codec->ps_pps_base >= MAX_PPS_CNT - 1))
+                return IHEVCD_INVALID_HEADER;
+        }
 
         ihevcd_copy_pps(ps_codec, pps_id, ps_pps_ref->i1_pps_id);
     }