commit dae90ebf481002c13acb965341363f6ace020428
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Fri Jan 13 17:46:11 2017 +0530
committer gitbuildkicker <android-build@google.com> Tue Feb 21 17:18:16 2017 -0800
tree 864c6f566426bedb2b81ef8c42ea144f88168189
parent 1336cf66540409f803f1d0b972f36d35da6423d3

Handle invalid num_reorder_pics & max_dec_pic_buffering in SPS

Bug: 33864300
Change-Id: I920e45c3420a1a41a366ad45bd4186c5f6af6d6b
(cherry picked from commit 1ab5ce7e42feccd49e49752e6f58f9097ac5d254)

decoder/ihevcd_parse_headers.c

diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index 17de2a2..3cae4e5 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1312,9 +1312,19 @@
         UEV_PARSE("max_dec_pic_buffering", value, ps_bitstrm);
         ps_sps->ai1_sps_max_dec_pic_buffering[i] = value + 1;
 
+        if(ps_sps->ai1_sps_max_dec_pic_buffering[i] > MAX_DPB_SIZE)
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
+
         UEV_PARSE("num_reorder_pics", value, ps_bitstrm);
         ps_sps->ai1_sps_max_num_reorder_pics[i] = value;
 
+        if(ps_sps->ai1_sps_max_num_reorder_pics[i] > ps_sps->ai1_sps_max_dec_pic_buffering[i])
+        {
+            return IHEVCD_INVALID_PARAMETER;
+        }
+
         UEV_PARSE("max_latency_increase", value, ps_bitstrm);
         ps_sps->ai1_sps_max_latency_increase[i] = value;
     }