commit 9ca86207e923a81a053943347dfef86b294602f8
author Naveen Kumar P <naveenkumar.p@ittiam.com> Fri Jun 16 19:39:15 2017 +0000
committer android-build-merger <android-build-merger@google.com> Fri Jun 16 19:39:15 2017 +0000
tree 45023d65c7f61f25780033fca3ba80e4eea8ec84
parent 0f0af457e854a03a9263c2664e4535222baf7cbc
parent 7173cefc97557670e4ab71b7629b62466b1a390a

Return error for invalid crop parameters am: e8c26c16d7 am: 870c70383d am: 6850014493 am: fc0890497a am: 78e98c5480 am: 04276b9d82 am: 030250ff1b am: d3cf23089c am: b34985456f am: cf896561a1 am: 457356f474
am: 7173cefc97

Change-Id: Iaf5ab8a8056f32248b793dee6b18b25997042f8b

decoder/ihevcd_parse_headers.c

diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index 2faddd7..28ab962 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1363,15 +1363,31 @@
     {
 
         UEV_PARSE("pic_crop_left_offset", value, ps_bitstrm);
+        if (value >= ps_sps->i2_pic_width_in_luma_samples)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
         ps_sps->i2_pic_crop_left_offset = value;
 
         UEV_PARSE("pic_crop_right_offset", value, ps_bitstrm);
+        if (value >= ps_sps->i2_pic_width_in_luma_samples)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
         ps_sps->i2_pic_crop_right_offset = value;
 
         UEV_PARSE("pic_crop_top_offset", value, ps_bitstrm);
+        if (value >= ps_sps->i2_pic_height_in_luma_samples)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
         ps_sps->i2_pic_crop_top_offset = value;
 
         UEV_PARSE("pic_crop_bottom_offset", value, ps_bitstrm);
+        if (value >= ps_sps->i2_pic_height_in_luma_samples)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
         ps_sps->i2_pic_crop_bottom_offset = value;
     }
     else