commit 9b546d6f830794f99c3d91631f8547d27e6d4cf5
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Thu May 25 16:38:51 2017 +0530
committer android-build-team Robot <android-build-team-robot@google.com> Thu Sep 21 23:15:52 2017 +0000
tree 63d63881d8f7351d0d3907226a4fd26c1b9ee569
parent 86fb2754ea05f4613eab386ce3d7a33bf4f10ae6

Added an out of bound check on u4_num_bufs in input argument

ps_dec_ip->s_out_buffer.u4_num_bufs was missing out of bound checks

Bug: 35430570
Change-Id: Ibbf9891a885f69e208107725e34e7217147b891e
(cherry picked from commit 8221313d58ad4ebe9875760f065d999928172d6e)

decoder/ihevcd_decode.c

diff --git a/decoder/ihevcd_decode.c b/decoder/ihevcd_decode.c
index dfb5042..6f38e90 100644
--- a/decoder/ihevcd_decode.c
+++ b/decoder/ihevcd_decode.c
@@ -456,7 +456,8 @@
     if(0 == ps_codec->i4_share_disp_buf && ps_codec->i4_header_mode == 0)
     {
         UWORD32 i;
-        if(ps_dec_ip->s_out_buffer.u4_num_bufs == 0)
+        if((ps_dec_ip->s_out_buffer.u4_num_bufs <= 0) ||
+           (ps_dec_ip->s_out_buffer.u4_num_bufs > IVD_VIDDEC_MAX_IO_BUFFERS))
         {
             ps_dec_op->u4_error_code |= 1 << IVD_UNSUPPORTEDPARAM;
             ps_dec_op->u4_error_code |= IVD_DISP_FRM_ZERO_OP_BUFS;