commit 486b5165ff6d70a311b5d87e5001ae91442cd5ed
author Venkatarama Avadhani <venkatarama.avadhani@ittiam.com> Tue Feb 14 20:58:52 2017 +0000
committer android-build-merger <android-build-merger@google.com> Tue Feb 14 20:58:52 2017 +0000
tree c7a5b4e64b72960083e197197cdb91d37e5d4015
parent 7e80c06db4d0a82fd232395367e2a46ba640a054
parent 059366fec28e17d3cde6d572637ca527625b3945

Error Check for VLD Symbols Read am: 227c1f8291 am: 2743c1ad2d am: d26de2cd16 am: 50d29034a0 am: eb2364e3a8 am: b06bfd0514 am: 67ac3217e6
am: 059366fec2

Change-Id: Ib1b73976a8777fa3d9de8e422e2c5d57a8c9af9e

decoder/impeg2d_vld.c

diff --git a/decoder/impeg2d_vld.c b/decoder/impeg2d_vld.c
index 459548b..12bb617 100644
--- a/decoder/impeg2d_vld.c
+++ b/decoder/impeg2d_vld.c
@@ -638,6 +638,15 @@
                 u4_sym_len = 17;
                 IBITS_NXT(u4_buf,u4_buf_nxt,u4_offset,u4_bits,u4_sym_len)
 
+                /* There cannot be more than 11 leading zeros in the decoded
+                 * symbol. The symbol is only 17 bits long, so we subtract 15.
+                 */
+                lead_zeros = CLZ(u4_bits) - 15;
+                if (lead_zeros > 11)
+                {
+                    return IMPEG2D_MB_DATA_DECODE_ERR;
+                }
+
                 DecodedValue = gau2_impeg2d_tab_one_1_9[u4_bits >> 8];
                 u4_sym_len = (DecodedValue & 0xf);
                 u4_level = DecodedValue >> 9;
@@ -809,6 +818,14 @@
                 u4_sym_len = 17;
                 IBITS_NXT(u4_buf, u4_buf_nxt, u4_offset, u4_bits, u4_sym_len)
 
+                /* There cannot be more than 11 leading zeros in the decoded
+                 * symbol. The symbol is only 17 bits long, so we subtract 15.
+                 */
+                lead_zeros = CLZ(u4_bits) - 15;
+                if (lead_zeros > 11)
+                {
+                    return IMPEG2D_MB_DATA_DECODE_ERR;
+                }
 
                 DecodedValue = gau2_impeg2d_tab_zero_1_9[u4_bits >> 8];
                 u4_sym_len = BITS(DecodedValue, 3, 0);