commit bf26b24f52c17313ecaa58ca6d0bfe5c2c374b58
author Venkatarama Avadhani <venkatarama.avadhani@ittiam.com> Tue Jun 27 11:31:45 2017 +0530
committer Nikoli Cartagena <dargeren@google.com> Tue Sep 19 15:42:22 2017 -0700
tree cb28cd34a6e642d16cbec3e43b41cda1ddec3cf7
parent 08d17149ab10a91c6e4d109642473c41b7460f35

Check on Picture Dimensions

Adding error check to ensure that the picture being decoded is not larger than
the maximum width and height passed to init decoder call.

Bug: 63121644
Test: ran POC before/after with desired results.
Change-Id: Id51a2ef8c92d48b4088a895f85688d2b543aa996
(cherry picked from commit dd89269aa283dd740fd16c6d7d3cf225b3623338)

decoder/impeg2d_dec_hdr.c

diff --git a/decoder/impeg2d_dec_hdr.c b/decoder/impeg2d_dec_hdr.c
index 3743af3..46502c4 100644
--- a/decoder/impeg2d_dec_hdr.c
+++ b/decoder/impeg2d_dec_hdr.c
@@ -281,6 +281,8 @@
 IMPEG2D_ERROR_CODES_T impeg2d_dec_seq_ext(dec_state_t *ps_dec)
 {
     stream_t *ps_stream;
+    UWORD16 horizontal_value;
+    UWORD16 vertical_value;
 
     ps_stream = &ps_dec->s_bit_stream;
 
@@ -330,11 +332,30 @@
     if(impeg2d_bit_stream_get(ps_stream,2) != 0x1)
         return IMPEG2D_CHROMA_FMT_NOT_SUP;
 
+    /* Error resilience: store the 2 most significant bit in horizontal and vertical   */
+    /* variables.Use it only if adding them to the vertical and horizontal sizes       */
+    /* respectively, doesn't exceed the MAX_WD and MAX_HT supported by the application.*/
+
+
     /* Read the 2 most significant bits from horizontal_size */
-    ps_dec->u2_horizontal_size    += (impeg2d_bit_stream_get(ps_stream,2) << 12);
+    horizontal_value               = (impeg2d_bit_stream_get(ps_stream,2) << 12);
 
     /* Read the 2 most significant bits from vertical_size */
-    ps_dec->u2_vertical_size      += (impeg2d_bit_stream_get(ps_stream,2) << 12);
+    vertical_value                 = (impeg2d_bit_stream_get(ps_stream,2) << 12);
+
+    /* Error resilience: The height and width should not be more than the*/
+    /*max height and width the application can support*/
+    if(ps_dec->u2_create_max_height < (ps_dec->u2_vertical_size + vertical_value))
+    {
+        return (IMPEG2D_ERROR_CODES_T) IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED;
+    }
+
+    if(ps_dec->u2_create_max_width < (ps_dec->u2_horizontal_size + horizontal_value))
+    {
+        return (IMPEG2D_ERROR_CODES_T) IVD_STREAM_WIDTH_HEIGHT_NOT_SUPPORTED;
+    }
+    ps_dec->u2_vertical_size       += vertical_value;
+    ps_dec->u2_horizontal_size     += horizontal_value;
 
     /*-----------------------------------------------------------------------*/
     /* Flush the following as they are not used now                          */