Fixed out of bound read in flush_bits am: 763ffef681 am: 16620937c2 am: cb0ef8df6e
am: 8a34f810ab
* commit '8a34f810ab8cc44db2251e8dc1c078fea3d36b6e':
Fixed out of bound read in flush_bits
Change-Id: If2bf55fa0d027e958d2e1e36ffe407e8944523a0
diff --git a/decoder/impeg2d_bitstream.c b/decoder/impeg2d_bitstream.c
index b67161d..36092e5 100644
--- a/decoder/impeg2d_bitstream.c
+++ b/decoder/impeg2d_bitstream.c
@@ -191,12 +191,21 @@
INLINE void impeg2d_bit_stream_flush(void* pv_ctxt, UWORD32 u4_no_of_bits)
{
stream_t *ps_stream = (stream_t *)pv_ctxt;
-
-
- if (ps_stream->u4_offset < ps_stream->u4_max_offset)
+ if ((ps_stream->u4_offset + 64) < ps_stream->u4_max_offset)
{
FLUSH_BITS(ps_stream->u4_offset,ps_stream->u4_buf,ps_stream->u4_buf_nxt,u4_no_of_bits,ps_stream->pu4_buf_aligned)
}
+ else
+ {
+ UWORD32 u4_temp;
+
+ if (((ps_stream->u4_offset & 0x1f) + u4_no_of_bits) >= 32)
+ {
+ ps_stream->u4_buf = ps_stream->u4_buf_nxt;
+ ps_stream->u4_buf_nxt = 0;
+ }
+ ps_stream->u4_offset += u4_no_of_bits;
+ }
return;
}
/******************************************************************************