diff options
| author | Srujan Vandrangi <srujan.vandrangi@ittiam.com> | 2023-10-23 11:56:39 +0530 |
|---|---|---|
| committer | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | 2023-10-25 06:56:55 -0700 |
| commit | 3c03b2bcf77bb2de9d4fa4bfdf77b818fd7c492a (patch) | |
| tree | 1ee99a347edeebdac1607715451c084c4b7dfa05 | |
| parent | 90aefb438bb5ef02a485b2d491426119e328f5f5 (diff) | |
| download | libhevc-3c03b2bcf77bb2de9d4fa4bfdf77b818fd7c492a.tar.gz | |
decoder: add check for luma height while parsing sps
Bug: oss-fuzz:60439
Test: ./hevc_dec_fuzzer
| -rw-r--r-- | decoder/ihevcd_parse_headers.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c index 0ce1b27..866e6b5 100644 --- a/decoder/ihevcd_parse_headers.c +++ b/decoder/ihevcd_parse_headers.c @@ -1893,7 +1893,10 @@ IHEVCD_ERROR_T ihevcd_parse_sps(codec_t *ps_codec) return (IHEVCD_ERROR_T)IVD_RES_CHANGED; } + // Ensure both i2_pic_width_in_luma_samples and i2_pic_height_in_luma_samples do + // not exceed MAX_WD and their product doesn't exceed MAX_WD * MAX_HT if((ps_sps->i2_pic_width_in_luma_samples > MAX_WD) || + (ps_sps->i2_pic_height_in_luma_samples > MAX_WD) || ((ps_sps->i2_pic_width_in_luma_samples * ps_sps->i2_pic_height_in_luma_samples) > (MAX_WD * MAX_HT))) { |