commit cf896561a19d761802a6ae0a1c9ce4853fdcf215
author Naveen Kumar P <naveenkumar.p@ittiam.com> Fri Jun 16 19:19:44 2017 +0000
committer android-build-merger <android-build-merger@google.com> Fri Jun 16 19:19:44 2017 +0000
tree 389a11182e5781f8401aec31af647e3c376c66e2
parent 9aff8b16b96dfad5a3d6c08c9905ef33e3336ad5
parent b34985456f4a2e5ccb519a715c92abb9ccaaea82

Return error for invalid crop parameters am: e8c26c16d7 am: 870c70383d am: 6850014493 am: fc0890497a am: 78e98c5480 am: 04276b9d82 am: 030250ff1b am: d3cf23089c
am: b34985456f

Change-Id: Ie47fd2a0aa26a2610ec13b6b292229f797c280c0

decoder/ihevcd_parse_headers.c

diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index 4669d5a..c8fa3f3 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1285,15 +1285,31 @@
     {
 
         UEV_PARSE("pic_crop_left_offset", value, ps_bitstrm);
+        if (value >= ps_sps->i2_pic_width_in_luma_samples)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
         ps_sps->i2_pic_crop_left_offset = value;
 
         UEV_PARSE("pic_crop_right_offset", value, ps_bitstrm);
+        if (value >= ps_sps->i2_pic_width_in_luma_samples)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
         ps_sps->i2_pic_crop_right_offset = value;
 
         UEV_PARSE("pic_crop_top_offset", value, ps_bitstrm);
+        if (value >= ps_sps->i2_pic_height_in_luma_samples)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
         ps_sps->i2_pic_crop_top_offset = value;
 
         UEV_PARSE("pic_crop_bottom_offset", value, ps_bitstrm);
+        if (value >= ps_sps->i2_pic_height_in_luma_samples)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
         ps_sps->i2_pic_crop_bottom_offset = value;
     }
     else