Adding Error Check For PictureStructure Param
Checking to ensure the picture structure read in dec_pic_coding_ext is
valid. If invalid, decode should not procede because the buffer obtained
to decode a picture with invalid picture structure will not be freed.
Bug: 37273673
Change-Id: I1469bb7b5daeab285ad55dcb77f54d0cb5d19dad
(cherry picked from commit f7546c1710348b975e204b07317a7bfb3c9c69de)
diff --git a/decoder/impeg2d_dec_hdr.c b/decoder/impeg2d_dec_hdr.c
index 770f4f2..4a84086 100644
--- a/decoder/impeg2d_dec_hdr.c
+++ b/decoder/impeg2d_dec_hdr.c
@@ -716,11 +716,12 @@
* Arguments :
* dec : Decoder context
*
-* Values Returned : None
+* Values Returned : Error
*******************************************************************************/
-void impeg2d_dec_pic_coding_ext(dec_state_t *ps_dec)
+IMPEG2D_ERROR_CODES_T impeg2d_dec_pic_coding_ext(dec_state_t *ps_dec)
{
stream_t *ps_stream;
+ IMPEG2D_ERROR_CODES_T e_error = (IMPEG2D_ERROR_CODES_T) IV_SUCCESS;
ps_stream = &ps_dec->s_bit_stream;
impeg2d_bit_stream_flush(ps_stream,START_CODE_LEN);
@@ -733,6 +734,11 @@
ps_dec->au2_f_code[1][1] = impeg2d_bit_stream_get(ps_stream,4);
ps_dec->u2_intra_dc_precision = impeg2d_bit_stream_get(ps_stream,2);
ps_dec->u2_picture_structure = impeg2d_bit_stream_get(ps_stream,2);
+ if (ps_dec->u2_picture_structure < TOP_FIELD ||
+ ps_dec->u2_picture_structure > FRAME_PICTURE)
+ {
+ return IMPEG2D_FRM_HDR_DECODE_ERR;
+ }
ps_dec->u2_top_field_first = impeg2d_bit_stream_get_bit(ps_stream);
ps_dec->u2_frame_pred_frame_dct = impeg2d_bit_stream_get_bit(ps_stream);
ps_dec->u2_concealment_motion_vectors = impeg2d_bit_stream_get_bit(ps_stream);
@@ -760,6 +766,7 @@
{
ps_dec->pu1_inv_scan_matrix = (UWORD8 *)gau1_impeg2_inv_scan_zig_zag;
}
+ return e_error;
}
/*******************************************************************************
@@ -1724,7 +1731,11 @@
{
return e_error;
}
- impeg2d_dec_pic_coding_ext(ps_dec);
+ e_error = impeg2d_dec_pic_coding_ext(ps_dec);
+ if ((IMPEG2D_ERROR_CODES_T)IVD_ERROR_NONE != e_error)
+ {
+ return e_error;
+ }
e_error = impeg2d_dec_pic_ext_data(ps_dec);
if ((IMPEG2D_ERROR_CODES_T)IVD_ERROR_NONE != e_error)
{