commit 9d0b5796c862cd8edf0dad8672a4a393edbfdf6c
author Naveen Kumar P <naveenkumar.p@ittiam.com> Fri Mar 31 17:44:24 2017 +0530
committer android-build-team Robot <android-build-team-robot@google.com> Fri Apr 21 20:39:16 2017 +0000
tree b2338f2cbd42d70162cd958f1e7df016e0422d95
parent ddb5265a0b75f17ad9347181783cbc5a0c28c852

Correct Tiles rows and cols check

Change-Id: I70d7cdc820c68a4e206934eb00841d016bce5706

decoder/ihevcd_parse_headers.c

diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index 97f10ca..b560a39 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1755,6 +1755,12 @@
     ps_pps->i1_loop_filter_across_tiles_enabled_flag = 0;
     if(ps_pps->i1_tiles_enabled_flag)
     {
+        WORD32 wd = ALIGN64(ps_codec->i4_wd);
+        WORD32 ht = ALIGN64(ps_codec->i4_ht);
+
+        WORD32 max_tile_cols = (wd + MIN_TILE_WD - 1) / MIN_TILE_WD;
+        WORD32 max_tile_rows = (ht + MIN_TILE_HT - 1) / MIN_TILE_HT;
+
         UEV_PARSE("num_tile_columns_minus1", value, ps_bitstrm);
         ps_pps->i1_num_tile_columns = value + 1;
 
@@ -1762,9 +1768,9 @@
         ps_pps->i1_num_tile_rows = value + 1;
 
         if((ps_pps->i1_num_tile_columns < 1) ||
-                        (ps_pps->i1_num_tile_columns > ps_sps->i2_pic_wd_in_ctb) ||
+                        (ps_pps->i1_num_tile_columns > max_tile_cols) ||
                         (ps_pps->i1_num_tile_rows < 1) ||
-                        (ps_pps->i1_num_tile_rows > ps_sps->i2_pic_ht_in_ctb))
+                        (ps_pps->i1_num_tile_rows > max_tile_rows))
             return IHEVCD_INVALID_HEADER;
 
         BITS_PARSE("uniform_spacing_flag", value, ps_bitstrm, 1);