DO NOT MERGE - Merge pie-platform-release (PPRL.190705.004) into master
Bug: 136196576
Change-Id: I56982f3e2f123684c2ba748da659c056f567ecb0
diff --git a/common/ihevc_defs.h b/common/ihevc_defs.h
index 1878f30..58761eb 100644
--- a/common/ihevc_defs.h
+++ b/common/ihevc_defs.h
@@ -333,10 +333,14 @@
/* CTB Size Range */
#define MAX_CTB_SIZE 64
#define MIN_CTB_SIZE 16
+#define LOG2_MAX_CTB_SIZE 6
+#define LOG2_MIN_CTB_SIZE 4
/* TU Size Range */
#define MAX_TU_SIZE 32
#define MIN_TU_SIZE 4
+#define LOG2_MAX_TU_SIZE 5
+#define LOG2_MIN_TU_SIZE 2
/* Max Transform Size */
#define MAX_TRANS_SIZE (MAX_TU_SIZE*MAX_TU_SIZE)
@@ -344,11 +348,14 @@
/* PU Size Range */
#define MAX_PU_SIZE 64
#define MIN_PU_SIZE 4
+#define LOG2_MAX_PU_SIZE 6
+#define LOG2_MIN_PU_SIZE 2
/* CU Size Range */
#define MAX_CU_SIZE 64
#define MIN_CU_SIZE 8
-
+#define LOG2_MAX_CU_SIZE 6
+#define LOG2_MIN_CU_SIZE 3
/* Number of max TU in a CTB row */
#define MAX_TU_IN_CTB_ROW ((MAX_CTB_SIZE / MIN_TU_SIZE))
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index 3f67998..73142f6 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1459,17 +1459,37 @@
}
UEV_PARSE("log2_min_coding_block_size_minus3", value, ps_bitstrm);
+ if(value > (LOG2_MAX_CU_SIZE - 3))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_sps->i1_log2_min_coding_block_size = value + 3;
UEV_PARSE("log2_diff_max_min_coding_block_size", value, ps_bitstrm);
+ if(value > (LOG2_MAX_CU_SIZE - LOG2_MIN_CU_SIZE))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_sps->i1_log2_diff_max_min_coding_block_size = value;
ctb_log2_size_y = ps_sps->i1_log2_min_coding_block_size + ps_sps->i1_log2_diff_max_min_coding_block_size;
UEV_PARSE("log2_min_transform_block_size_minus2", value, ps_bitstrm);
+ if(value > (LOG2_MAX_TU_SIZE - 2))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_sps->i1_log2_min_transform_block_size = value + 2;
+ if(ps_sps->i1_log2_min_transform_block_size >= ps_sps->i1_log2_min_coding_block_size)
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
UEV_PARSE("log2_diff_max_min_transform_block_size", value, ps_bitstrm);
+ if(value > (LOG2_MAX_TU_SIZE - LOG2_MIN_TU_SIZE))
+ {
+ return IHEVCD_INVALID_PARAMETER;
+ }
ps_sps->i1_log2_diff_max_min_transform_block_size = value;
ps_sps->i1_log2_max_transform_block_size = ps_sps->i1_log2_min_transform_block_size +
@@ -1565,7 +1585,13 @@
ps_sps->i1_num_short_term_ref_pic_sets = value;
for(i = 0; i < ps_sps->i1_num_short_term_ref_pic_sets; i++)
- ihevcd_short_term_ref_pic_set(ps_bitstrm, &ps_sps->as_stref_picset[0], ps_sps->i1_num_short_term_ref_pic_sets, i, &ps_sps->as_stref_picset[i]);
+ {
+ ret = ihevcd_short_term_ref_pic_set(ps_bitstrm, &ps_sps->as_stref_picset[0], ps_sps->i1_num_short_term_ref_pic_sets, i, &ps_sps->as_stref_picset[i]);
+ if (ret != IHEVCD_SUCCESS)
+ {
+ return ret;
+ }
+ }
BITS_PARSE("long_term_ref_pics_present_flag", value, ps_bitstrm, 1);
ps_sps->i1_long_term_ref_pics_present_flag = value;
@@ -1995,6 +2021,10 @@
{
UEV_PARSE("column_width_minus1[ i ]", value, ps_bitstrm);
value += 1;
+ if (value >= ps_sps->i2_pic_wd_in_ctb - start)
+ {
+ return IHEVCD_INVALID_HEADER;
+ }
}
else
{
@@ -2031,6 +2061,10 @@
UEV_PARSE("row_height_minus1[ i ]", value, ps_bitstrm);
value += 1;
+ if (value >= ps_sps->i2_pic_ht_in_ctb - start)
+ {
+ return IHEVCD_INVALID_HEADER;
+ }
}
else
{
diff --git a/decoder/ihevcd_parse_slice_header.c b/decoder/ihevcd_parse_slice_header.c
index 70998f7..2ef174c 100644
--- a/decoder/ihevcd_parse_slice_header.c
+++ b/decoder/ihevcd_parse_slice_header.c
@@ -436,12 +436,15 @@
}
else
{
- ihevcd_short_term_ref_pic_set(ps_bitstrm,
- &ps_sps->as_stref_picset[0],
- ps_sps->i1_num_short_term_ref_pic_sets,
- ps_sps->i1_num_short_term_ref_pic_sets,
- &ps_slice_hdr->s_stref_picset);
-
+ ret = ihevcd_short_term_ref_pic_set(ps_bitstrm,
+ &ps_sps->as_stref_picset[0],
+ ps_sps->i1_num_short_term_ref_pic_sets,
+ ps_sps->i1_num_short_term_ref_pic_sets,
+ &ps_slice_hdr->s_stref_picset);
+ if (ret != IHEVCD_SUCCESS)
+ {
+ return ret;
+ }
st_rps_idx = ps_sps->i1_num_short_term_ref_pic_sets;
num_neg_pics = ps_slice_hdr->s_stref_picset.i1_num_neg_pics;
num_pos_pics = ps_slice_hdr->s_stref_picset.i1_num_pos_pics;
