commit cb2f13968e69e894d51b63168b0831d7fec2c29a
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Fri Apr 05 12:54:40 2019 -0700
committer hamzeh <hamzeh@google.com> Fri May 10 14:17:50 2019 -0700
tree 0ae201b599228523f9c024b28b659129bee52d85
parent 2a3e5c0e7e2afe515573ef8c29f2c4c9e6c2f0a2

Add bounds check for tile dimensions

Bug: 129976164
Bug: 130024844
Test: vendor/poc
Change-Id: I1e54babaec9c5ad199b60c7cfc1e24e36422f630
(cherry picked from commit 05f83e945884735a665555d171dec4cfdefa3956)

decoder/ihevcd_parse_headers.c

diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index 0ad0faf..4f9497c 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1908,6 +1908,10 @@
                     {
                         UEV_PARSE("column_width_minus1[ i ]", value, ps_bitstrm);
                         value += 1;
+                        if (value >= ps_sps->i2_pic_wd_in_ctb - start)
+                        {
+                            return IHEVCD_INVALID_HEADER;
+                        }
                     }
                     else
                     {
@@ -1944,6 +1948,10 @@
 
                         UEV_PARSE("row_height_minus1[ i ]", value, ps_bitstrm);
                         value += 1;
+                        if (value >= ps_sps->i2_pic_ht_in_ctb - start)
+                        {
+                            return IHEVCD_INVALID_HEADER;
+                        }
                     }
                     else
                     {