commit f7214c0a7ce4bd14b978f63df401b05d08f8e336
author Naveen Kumar P <naveenkumar.p@ittiam.com> Thu Oct 12 15:28:20 2017 +0530
committer Nikoli Cartagena <dargeren@google.com> Tue Nov 28 21:30:38 2017 -0800
tree c7ccf341df8197ffb25df6959fc845f4bc64bf17
parent 9d5179287a5316e83d23286ee1f25e8170f78156

Return error for negative crop parameters

Bug: 65398821
Change-Id: I18a94d40d77504bb9c9d5a5e7bf41207aed28712
Signed-off-by: Sungtak Lee <taklee@google.com>
(cherry picked from commit 978d3320ef3dc60f69f8c4ba215b869d11b03944)

decoder/ihevcd_parse_headers.c

diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index a7ec5ad..578a429 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1363,28 +1363,28 @@
     {
 
         UEV_PARSE("pic_crop_left_offset", value, ps_bitstrm);
-        if (value >= ps_sps->i2_pic_width_in_luma_samples)
+        if (value < 0 || value >= ps_sps->i2_pic_width_in_luma_samples)
         {
             return IHEVCD_INVALID_PARAMETER;
         }
         ps_sps->i2_pic_crop_left_offset = value;
 
         UEV_PARSE("pic_crop_right_offset", value, ps_bitstrm);
-        if (value >= ps_sps->i2_pic_width_in_luma_samples)
+        if (value < 0 || value >= ps_sps->i2_pic_width_in_luma_samples)
         {
             return IHEVCD_INVALID_PARAMETER;
         }
         ps_sps->i2_pic_crop_right_offset = value;
 
         UEV_PARSE("pic_crop_top_offset", value, ps_bitstrm);
-        if (value >= ps_sps->i2_pic_height_in_luma_samples)
+        if (value < 0 || value >= ps_sps->i2_pic_height_in_luma_samples)
         {
             return IHEVCD_INVALID_PARAMETER;
         }
         ps_sps->i2_pic_crop_top_offset = value;
 
         UEV_PARSE("pic_crop_bottom_offset", value, ps_bitstrm);
-        if (value >= ps_sps->i2_pic_height_in_luma_samples)
+        if (value < 0 || value >= ps_sps->i2_pic_height_in_luma_samples)
         {
             return IHEVCD_INVALID_PARAMETER;
         }