commit 6faab340d2ff6be1a25ae5d7ccb5fca2f177eef9
author Naveen Kumar P <naveenkumar.p@ittiam.com> Wed May 17 14:15:44 2017 +0530
committer android-build-team Robot <android-build-team-robot@google.com> Mon Jun 11 22:26:16 2018 +0000
tree 8dd533f87a22809f01de101cad2f85133b5fe499
parent 39e63bfc32809a794e65b47c68185b4943f51d08

Return error for invalid reorder parameter

Bug: 62689208
Test: before/after process PoC on ASAN builds.
Change-Id: Ib1404bdf512fba28c2641f3f2022811a2a2d7751
(cherry picked from commit 4286d31e9e121e1005ad8986bcbf9ba3f62122ee)

decoder/ihevcd_parse_headers.c

diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index b8ed252..8d811fd 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1414,20 +1414,18 @@
     for(; i < ps_sps->i1_sps_max_sub_layers; i++)
     {
         UEV_PARSE("max_dec_pic_buffering", value, ps_bitstrm);
+        if((value + 1) > MAX_DPB_SIZE)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
         ps_sps->ai1_sps_max_dec_pic_buffering[i] = value + 1;
 
-        if(ps_sps->ai1_sps_max_dec_pic_buffering[i] > MAX_DPB_SIZE)
-        {
-            return IHEVCD_INVALID_PARAMETER;
-        }
-
         UEV_PARSE("num_reorder_pics", value, ps_bitstrm);
-        ps_sps->ai1_sps_max_num_reorder_pics[i] = value;
-
-        if(ps_sps->ai1_sps_max_num_reorder_pics[i] > ps_sps->ai1_sps_max_dec_pic_buffering[i])
+        if(value > ps_sps->ai1_sps_max_dec_pic_buffering[i])
         {
             return IHEVCD_INVALID_PARAMETER;
         }
+        ps_sps->ai1_sps_max_num_reorder_pics[i] = value;
 
         UEV_PARSE("max_latency_increase", value, ps_bitstrm);
         ps_sps->ai1_sps_max_latency_increase[i] = value;