commit 8549298decd96721c192602283854ed7ab22a80c
author Naveen Kumar P <naveenkumar.p@ittiam.com> Wed Apr 05 10:31:08 2017 +0530
committer android-build-team Robot <android-build-team-robot@google.com> Thu May 25 18:10:42 2017 +0000
tree 8064b4591f712202391b0498f00f145368fc51f9
parent 47e9b7465c137b790f0442ec2f0aea9ed32c42f3

Check for cpb cnt in hrd parsing

Bug: 34896431

The arrays in hrd are of size MAX_CPB_CNT. If cpb cnt is more
than MAX_CPB_CNT, more data is parsed and the subsequent buffer
is corrupted.

Change-Id: I74c01b8c7142b67a358eb5e36b160a7fbf2b69e4
(cherry picked from commit 3e194e0edde1d9ceb71d18f6f0e0bf156a76a650)

decoder/ihevcd_parse_headers.c

diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index b560a39..edfaf5a 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -644,6 +644,9 @@
         if(!ps_hrd->au1_low_delay_hrd_flag[i])
             UEV_PARSE("cpb_cnt_minus1[ i ]", ps_hrd->au1_cpb_cnt_minus1[i], ps_bitstrm);
 
+        if(ps_hrd->au1_cpb_cnt_minus1[i] >= (MAX_CPB_CNT - 1))
+            return IHEVCD_INVALID_PARAMETER;
+
         if(ps_hrd->u1_nal_hrd_parameters_present_flag)
             ihevcd_parse_sub_layer_hrd_parameters(ps_bitstrm,
                                                   &ps_hrd->as_sub_layer_hrd_params[i],
@@ -744,7 +747,10 @@
 
         BITS_PARSE("vui_hrd_parameters_present_flag", ps_vui->u1_vui_hrd_parameters_present_flag, ps_bitstrm, 1);
         if(ps_vui->u1_vui_hrd_parameters_present_flag)
-            ihevcd_parse_hrd_parameters(ps_bitstrm, &ps_vui->s_vui_hrd_parameters, 1, sps_max_sub_layers_minus1);
+        {
+            ret = ihevcd_parse_hrd_parameters(ps_bitstrm, &ps_vui->s_vui_hrd_parameters, 1, sps_max_sub_layers_minus1);
+            RETURN_IF((ret != (IHEVCD_ERROR_T)IHEVCD_SUCCESS), ret);
+        }
     }
 
     BITS_PARSE("bitstream_restriction_flag", ps_vui->u1_bitstream_restriction_flag, ps_bitstrm, 1);
@@ -1456,9 +1462,12 @@
     ps_sps->i1_vui_parameters_present_flag = value;
 
     if(ps_sps->i1_vui_parameters_present_flag)
-        ihevcd_parse_vui_parameters(ps_bitstrm,
-                                    &ps_sps->s_vui_parameters,
-                                    ps_sps->i1_sps_max_sub_layers - 1);
+    {
+        ret = ihevcd_parse_vui_parameters(ps_bitstrm,
+                                          &ps_sps->s_vui_parameters,
+                                          ps_sps->i1_sps_max_sub_layers - 1);
+        RETURN_IF((ret != (IHEVCD_ERROR_T)IHEVCD_SUCCESS), ret);
+    }
 
     BITS_PARSE("sps_extension_flag", value, ps_bitstrm, 1);