commit f0afcf1943a1844e2a82ac3c5ab4d49427102cd1
author Venkatarama Avadhani <venkatarama.avadhani@ittiam.com> Thu Apr 20 09:26:54 2017 +0530
committer android-build-team Robot <android-build-team-robot@google.com> Thu Jun 15 19:10:20 2017 +0000
tree a7d48dc00a2bc341d90d713e2fd63457ba359c95
parent 327496c59fb280273e23353061980dd72b07de1f

Adding Error Check For PictureStructure Param

Checking to ensure the picture structure read in dec_pic_coding_ext is
valid. If invalid, decode should not procede because the buffer obtained
to decode a picture with invalid picture structure will not be freed.

Bug: 37273673
Change-Id: I1469bb7b5daeab285ad55dcb77f54d0cb5d19dad
(cherry picked from commit f7546c1710348b975e204b07317a7bfb3c9c69de)

decoder/impeg2d_dec_hdr.c

diff --git a/decoder/impeg2d_dec_hdr.c b/decoder/impeg2d_dec_hdr.c
index 770f4f2..4a84086 100644
--- a/decoder/impeg2d_dec_hdr.c
+++ b/decoder/impeg2d_dec_hdr.c
@@ -716,11 +716,12 @@
 *  Arguments       :
 *  dec             : Decoder context
 *
-*  Values Returned : None
+*  Values Returned : Error
 *******************************************************************************/
-void impeg2d_dec_pic_coding_ext(dec_state_t *ps_dec)
+IMPEG2D_ERROR_CODES_T impeg2d_dec_pic_coding_ext(dec_state_t *ps_dec)
 {
     stream_t *ps_stream;
+    IMPEG2D_ERROR_CODES_T e_error = (IMPEG2D_ERROR_CODES_T) IV_SUCCESS;
 
     ps_stream = &ps_dec->s_bit_stream;
     impeg2d_bit_stream_flush(ps_stream,START_CODE_LEN);
@@ -733,6 +734,11 @@
     ps_dec->au2_f_code[1][1]             = impeg2d_bit_stream_get(ps_stream,4);
     ps_dec->u2_intra_dc_precision        = impeg2d_bit_stream_get(ps_stream,2);
     ps_dec->u2_picture_structure            = impeg2d_bit_stream_get(ps_stream,2);
+    if (ps_dec->u2_picture_structure < TOP_FIELD ||
+                    ps_dec->u2_picture_structure > FRAME_PICTURE)
+    {
+        return IMPEG2D_FRM_HDR_DECODE_ERR;
+    }
     ps_dec->u2_top_field_first              = impeg2d_bit_stream_get_bit(ps_stream);
     ps_dec->u2_frame_pred_frame_dct         = impeg2d_bit_stream_get_bit(ps_stream);
     ps_dec->u2_concealment_motion_vectors   = impeg2d_bit_stream_get_bit(ps_stream);
@@ -760,6 +766,7 @@
     {
         ps_dec->pu1_inv_scan_matrix = (UWORD8 *)gau1_impeg2_inv_scan_zig_zag;
     }
+    return e_error;
 }
 
 /*******************************************************************************
@@ -1724,7 +1731,11 @@
                 {
                     return e_error;
                 }
-                impeg2d_dec_pic_coding_ext(ps_dec);
+                e_error = impeg2d_dec_pic_coding_ext(ps_dec);
+                if ((IMPEG2D_ERROR_CODES_T)IVD_ERROR_NONE != e_error)
+                {
+                    return e_error;
+                }
                 e_error = impeg2d_dec_pic_ext_data(ps_dec);
                 if ((IMPEG2D_ERROR_CODES_T)IVD_ERROR_NONE != e_error)
                 {