Adding Error Check For PictureStructure Param Checking to ensure the picture structure read in dec_pic_coding_ext is valid. If invalid, decode should not procede because the buffer obtained to decode a picture with invalid picture structure will not be freed. Bug: 37273673 Change-Id: I1469bb7b5daeab285ad55dcb77f54d0cb5d19dad (cherry picked from commit f7546c1710348b975e204b07317a7bfb3c9c69de)
diff --git a/decoder/impeg2d_dec_hdr.c b/decoder/impeg2d_dec_hdr.c index 3118aff..27903b7 100644 --- a/decoder/impeg2d_dec_hdr.c +++ b/decoder/impeg2d_dec_hdr.c
@@ -708,11 +708,12 @@ * Arguments : * dec : Decoder context * -* Values Returned : None +* Values Returned : Error *******************************************************************************/ -void impeg2d_dec_pic_coding_ext(dec_state_t *ps_dec) +IMPEG2D_ERROR_CODES_T impeg2d_dec_pic_coding_ext(dec_state_t *ps_dec) { stream_t *ps_stream; + IMPEG2D_ERROR_CODES_T e_error = (IMPEG2D_ERROR_CODES_T) IV_SUCCESS; ps_stream = &ps_dec->s_bit_stream; impeg2d_bit_stream_flush(ps_stream,START_CODE_LEN); @@ -725,6 +726,11 @@ ps_dec->au2_f_code[1][1] = impeg2d_bit_stream_get(ps_stream,4); ps_dec->u2_intra_dc_precision = impeg2d_bit_stream_get(ps_stream,2); ps_dec->u2_picture_structure = impeg2d_bit_stream_get(ps_stream,2); + if (ps_dec->u2_picture_structure < TOP_FIELD || + ps_dec->u2_picture_structure > FRAME_PICTURE) + { + return IMPEG2D_FRM_HDR_DECODE_ERR; + } ps_dec->u2_top_field_first = impeg2d_bit_stream_get_bit(ps_stream); ps_dec->u2_frame_pred_frame_dct = impeg2d_bit_stream_get_bit(ps_stream); ps_dec->u2_concealment_motion_vectors = impeg2d_bit_stream_get_bit(ps_stream); @@ -752,6 +758,7 @@ { ps_dec->pu1_inv_scan_matrix = (UWORD8 *)gau1_impeg2_inv_scan_zig_zag; } + return e_error; } /******************************************************************************* @@ -1716,7 +1723,11 @@ { return e_error; } - impeg2d_dec_pic_coding_ext(ps_dec); + e_error = impeg2d_dec_pic_coding_ext(ps_dec); + if ((IMPEG2D_ERROR_CODES_T)IVD_ERROR_NONE != e_error) + { + return e_error; + } e_error = impeg2d_dec_pic_ext_data(ps_dec); if ((IMPEG2D_ERROR_CODES_T)IVD_ERROR_NONE != e_error) {