commit dce2f1a1a187d3b11d59f00969d9c51bb2e408d8
author TreeHugger Robot <treehugger-gerrit@google.com> Tue May 07 00:16:35 2019 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Tue May 07 00:16:35 2019 +0000
tree 16fa449170b625b574b94874d514956ebac9cbc9
parent 2b9fa38bb85b951b86e04246a6b0a70c6eb044da
parent adb9a9521f338717555f8e8249ba36cf42d008eb

Merge changes from topic "am-5b50c796-9c7d-4769-bc6c-f71bdac7c742" into oc-dev

* changes:
  [automerger] Add bounds check for tile dimensions am: 05f83e9458 am: 8ee7982e46 am: 7c6da2165b am: c11699b0f4 am: c0d441f4a7
  [automerger] Add bounds check for tile dimensions am: 05f83e9458 am: 8ee7982e46 am: 7c6da2165b am: c11699b0f4
  [automerger] Add bounds check for tile dimensions am: 05f83e9458 am: 8ee7982e46 am: 7c6da2165b
  [automerger] Add bounds check for tile dimensions am: 05f83e9458 am: 8ee7982e46
  [automerger] Add bounds check for tile dimensions am: 05f83e9458
  Add bounds check for tile dimensions

decoder/ihevcd_parse_headers.c

diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index 0371a57..7028d57 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1565,7 +1565,13 @@
     ps_sps->i1_num_short_term_ref_pic_sets = value;
 
     for(i = 0; i < ps_sps->i1_num_short_term_ref_pic_sets; i++)
-        ihevcd_short_term_ref_pic_set(ps_bitstrm, &ps_sps->as_stref_picset[0], ps_sps->i1_num_short_term_ref_pic_sets, i, &ps_sps->as_stref_picset[i]);
+    {
+        ret = ihevcd_short_term_ref_pic_set(ps_bitstrm, &ps_sps->as_stref_picset[0], ps_sps->i1_num_short_term_ref_pic_sets, i, &ps_sps->as_stref_picset[i]);
+        if (ret != IHEVCD_SUCCESS)
+        {
+            return ret;
+        }
+    }
 
     BITS_PARSE("long_term_ref_pics_present_flag", value, ps_bitstrm, 1);
     ps_sps->i1_long_term_ref_pics_present_flag = value;

decoder/ihevcd_parse_slice_header.c

diff --git a/decoder/ihevcd_parse_slice_header.c b/decoder/ihevcd_parse_slice_header.c
index 70998f7..2ef174c 100644
--- a/decoder/ihevcd_parse_slice_header.c
+++ b/decoder/ihevcd_parse_slice_header.c
@@ -436,12 +436,15 @@
             }
             else
             {
-                ihevcd_short_term_ref_pic_set(ps_bitstrm,
-                                              &ps_sps->as_stref_picset[0],
-                                              ps_sps->i1_num_short_term_ref_pic_sets,
-                                              ps_sps->i1_num_short_term_ref_pic_sets,
-                                              &ps_slice_hdr->s_stref_picset);
-
+                ret = ihevcd_short_term_ref_pic_set(ps_bitstrm,
+                                                    &ps_sps->as_stref_picset[0],
+                                                    ps_sps->i1_num_short_term_ref_pic_sets,
+                                                    ps_sps->i1_num_short_term_ref_pic_sets,
+                                                    &ps_slice_hdr->s_stref_picset);
+                if (ret != IHEVCD_SUCCESS)
+                {
+                    return ret;
+                }
                 st_rps_idx = ps_sps->i1_num_short_term_ref_pic_sets;
                 num_neg_pics = ps_slice_hdr->s_stref_picset.i1_num_neg_pics;
                 num_pos_pics = ps_slice_hdr->s_stref_picset.i1_num_pos_pics;