commit dce2f1a1a187d3b11d59f00969d9c51bb2e408d8
author TreeHugger Robot <treehugger-gerrit@google.com> Tue May 07 00:16:35 2019 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Tue May 07 00:16:35 2019 +0000
tree 16fa449170b625b574b94874d514956ebac9cbc9
parent 2b9fa38bb85b951b86e04246a6b0a70c6eb044da
parent adb9a9521f338717555f8e8249ba36cf42d008eb

Merge changes from topic "am-5b50c796-9c7d-4769-bc6c-f71bdac7c742" into oc-dev

* changes:
  [automerger] Add bounds check for tile dimensions am: 05f83e9458 am: 8ee7982e46 am: 7c6da2165b am: c11699b0f4 am: c0d441f4a7
  [automerger] Add bounds check for tile dimensions am: 05f83e9458 am: 8ee7982e46 am: 7c6da2165b am: c11699b0f4
  [automerger] Add bounds check for tile dimensions am: 05f83e9458 am: 8ee7982e46 am: 7c6da2165b
  [automerger] Add bounds check for tile dimensions am: 05f83e9458 am: 8ee7982e46
  [automerger] Add bounds check for tile dimensions am: 05f83e9458
  Add bounds check for tile dimensions

decoder/ihevcd_parse_headers.c

diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index c7e147d..7028d57 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -2001,6 +2001,10 @@
                     {
                         UEV_PARSE("column_width_minus1[ i ]", value, ps_bitstrm);
                         value += 1;
+                        if (value >= ps_sps->i2_pic_wd_in_ctb - start)
+                        {
+                            return IHEVCD_INVALID_HEADER;
+                        }
                     }
                     else
                     {
@@ -2037,6 +2041,10 @@
 
                         UEV_PARSE("row_height_minus1[ i ]", value, ps_bitstrm);
                         value += 1;
+                        if (value >= ps_sps->i2_pic_ht_in_ctb - start)
+                        {
+                            return IHEVCD_INVALID_HEADER;
+                        }
                     }
                     else
                     {