commit 7eb4618dde7593e4259073761095d9d681c9f794
author Naveen Kumar P <naveenkumar.p@ittiam.com> Fri Mar 09 08:34:01 2018 +0530
committer android-build-team Robot <android-build-team-robot@google.com> Fri May 25 18:38:33 2018 +0000
tree 0de928415b372fb8b93ec522bcd3d615f6c058fe
parent 3d6b32864c11c360d74e5dbd03a9f296b56fbd6e

Return error for invalid sps sub layers parameters

Return error for negative values of max_dec_pic_buffering and
num_reorder_pics sps parameters.

Bug: 73965867
Test: Ittiam
Change-Id: I6035b3b2fcbd29c6bbb1223f4714ba04b4bca6b3
(cherry picked from commit f4486cdb2ff81368baa1d6e7afcf2c06ba64e666)

decoder/ihevcd_parse_headers.c

diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index fb8ada9..4a05008 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1414,14 +1414,14 @@
     for(; i < ps_sps->i1_sps_max_sub_layers; i++)
     {
         UEV_PARSE("max_dec_pic_buffering", value, ps_bitstrm);
-        if((value + 1) > MAX_DPB_SIZE)
+        if(value < 0 || (value + 1) > MAX_DPB_SIZE)
         {
             return IHEVCD_INVALID_PARAMETER;
         }
         ps_sps->ai1_sps_max_dec_pic_buffering[i] = value + 1;
 
         UEV_PARSE("num_reorder_pics", value, ps_bitstrm);
-        if(value > ps_sps->ai1_sps_max_dec_pic_buffering[i])
+        if(value < 0 || value > ps_sps->ai1_sps_max_dec_pic_buffering[i])
         {
             return IHEVCD_INVALID_PARAMETER;
         }