commit 7cf440e7b5690cef728612e9f3f7c5bf6f994371
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Fri Jan 13 16:41:33 2017 +0530
committer Feng Yu <feny@google.com> Wed Feb 15 01:39:47 2017 +0000
tree a74a84400db3cf6e1c63ee048d9fbcb928ee842a
parent 2198a9a02db5559d63569f93be900a45a0dd94b4

Fix in handling wrong cu_qp_delta

cu_qp_delta is now checked for the range as specified in the spec
Bug: 33966031

Change-Id: I00420bf68081af92e9f2be9af7ce58d0683094ca
(cherry picked from commit 01ca88bb6c5bdd44e071f8effebe12f1d7da9853)

decoder/ihevcd_cabac.c

diff --git a/decoder/ihevcd_cabac.c b/decoder/ihevcd_cabac.c
index fa249c4..3a03aa8 100644
--- a/decoder/ihevcd_cabac.c
+++ b/decoder/ihevcd_cabac.c
@@ -669,14 +669,13 @@
     numones = k;
     bin = 1;
     u4_sym = 0;
-    while(bin)
+    while(bin && (numones <= 16))
     {
         IHEVCD_CABAC_DECODE_BYPASS_BIN(bin, ps_cabac, ps_bitstrm);
         u4_sym += bin << numones++;
     }
 
     numones -= 1;
-    numones = CLIP3(numones, 0, 16);
 
     if(numones)
     {

decoder/ihevcd_parse_slice.c

diff --git a/decoder/ihevcd_parse_slice.c b/decoder/ihevcd_parse_slice.c
index 853afee..96af4e1 100644
--- a/decoder/ihevcd_parse_slice.c
+++ b/decoder/ihevcd_parse_slice.c
@@ -82,6 +82,9 @@
 /* Bit stream offset threshold */
 #define BITSTRM_OFF_THRS 8
 
+#define MIN_CU_QP_DELTA_ABS(x) (-26 + ((x) * 6) / 2)
+#define MAX_CU_QP_DELTA_ABS(x) (25 + ((x) * 6) / 2)
+
 /**
  * Table used to decode part_mode if AMP is enabled and current CU is not min CU
  */
@@ -302,7 +305,6 @@
                     }
                     AEV_TRACE("cu_qp_delta_abs", cu_qp_delta_abs, ps_cabac->u4_range);
 
-
                     ps_codec->s_parse.i4_is_cu_qp_delta_coded = 1;
 
 
@@ -315,6 +317,13 @@
                             cu_qp_delta_abs = -cu_qp_delta_abs;
 
                     }
+
+                    if (cu_qp_delta_abs < MIN_CU_QP_DELTA_ABS(ps_sps->i1_bit_depth_luma_minus8)
+                                    || cu_qp_delta_abs > MAX_CU_QP_DELTA_ABS(ps_sps->i1_bit_depth_luma_minus8))
+                    {
+                        return IHEVCD_INVALID_PARAMETER;
+                    }
+
                     ps_codec->s_parse.s_cu.i4_cu_qp_delta = cu_qp_delta_abs;
 
                 }