commit a963ba6ac200ee4222ba4faa7137a69144ba668a
author Naveen Kumar P <naveenkumar.p@ittiam.com> Tue Aug 29 17:04:05 2017 +0530
committer Ray Essick <essick@google.com> Tue Oct 03 14:33:53 2017 -0700
tree 8cab9d791961abeba5b44b8623f577cf22a69cce
parent 7c8b6de447307092e1c13baae48de680550ff175

Fix overflow in sei timing params

Bug: 65186291
Test: run PoC before/after on ASAN build
Change-Id: I3696eb2be4a62a518e63816b7b788b06ae628ca6

decoder/ihevcd_parse_headers.c

diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index 10a906b..4714f3a 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -2337,9 +2337,18 @@
         if(ps_vui_hdr->u1_sub_pic_cpb_params_present_flag
                         && ps_vui_hdr->u1_sub_pic_cpb_params_in_pic_timing_sei_flag)
         {
+            UWORD32 num_units_minus1;
+            UWORD32 array_size;
+
             UEV_PARSE("num_decoding_units_minus1", value, ps_bitstrm);
             ps_pic_timing->u4_num_decoding_units_minus1 = value;
 
+            num_units_minus1 = ps_pic_timing->u4_num_decoding_units_minus1;
+            array_size = (sizeof(ps_pic_timing->au4_num_nalus_in_du_minus1)
+                       / sizeof(ps_pic_timing->au4_num_nalus_in_du_minus1[0]));
+            num_units_minus1 = CLIP3(num_units_minus1, 0,(array_size - 1));
+            ps_pic_timing->u4_num_decoding_units_minus1 = num_units_minus1;
+
             BITS_PARSE("du_common_cpb_removal_delay_flag", value, ps_bitstrm, 1);
             ps_pic_timing->u1_du_common_cpb_removal_delay_flag = value;