commit a8c54cf795c89e3635a9a8593d6bad77484ef7cb
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Fri Jan 13 17:22:34 2017 +0530
committer gitbuildkicker <android-build@google.com> Thu Mar 23 16:07:19 2017 -0700
tree 450c31b63b4a9347f2ef545241a95cb80c4b7972
parent cbeaf95f490b94649fc9c177fe20d9397a454635

Return error if SPS parsing reads more bytes than the nal length

Bug: 35039946

Change-Id: Ia97fa8711f313d0029d2b13e6d150d5e46b2bb99
(cherry picked from commit a6c58e18a49a1ea4929f8345b3c59f900d5813f5)
(cherry picked from commit 232bbe1908d1dd9f10513d7b8065ecaf5c9a11a6)

decoder/ihevcd_parse_headers.c

diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index 28a7ab5..97f10ca 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1462,6 +1462,10 @@
 
     BITS_PARSE("sps_extension_flag", value, ps_bitstrm, 1);
 
+    if((UWORD8 *)ps_bitstrm->pu4_buf > ps_bitstrm->pu1_buf_max)
+    {
+        return IHEVCD_INVALID_PARAMETER;
+    }
 
     {
         WORD32 numerator;