commit 5aee2541810f19aec67a1a9ea64973eb557aae9c
author Naveen Kumar P <naveenkumar.p@ittiam.com> Fri Sep 01 06:54:36 2017 -0700
committer Pawin Vongmasa <pawin@google.com> Fri Sep 08 21:15:45 2017 -0700
tree f59440c84b0f01d6b6d62d6a229459a4e0e60905
parent d743ed23ff2c31b300f86cf4f5bede1539c1e893

RESTRICT AUTOMERGE Fix heap buffer overflow

Test:
- Push multi_rec.hevc (in the bug thread) to the device
- Build:
mmm external/libhevc
- Run on device:
hevcdec --input multi_res.hevc  --num_frames -1 --num_cores 2

Bug: 62815506

Merged-In: I7e0828c9a9bb1e9997c379544ea5f4eb3556417d
Change-Id: I7e0828c9a9bb1e9997c379544ea5f4eb3556417d

decoder/ihevcd_parse_headers.c

diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index 506054b..cf1df16 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1534,10 +1534,14 @@
         ps_sps->i2_pic_ht_in_min_cb = numerator  /
                         (1 << ps_sps->i1_log2_min_coding_block_size);
     }
-    if((0 != ps_codec->i4_first_pic_done) &&
+    if((0 != ps_codec->i4_sps_done) &&
                     ((ps_codec->i4_wd != ps_sps->i2_pic_width_in_luma_samples) ||
                     (ps_codec->i4_ht != ps_sps->i2_pic_height_in_luma_samples)))
     {
+        if(0 == ps_codec->i4_first_pic_done)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
         ps_codec->i4_reset_flag = 1;
         return (IHEVCD_ERROR_T)IVD_RES_CHANGED;
     }