Merge cherrypicks of [3628702, 3628645, 3628777, 3628703, 3628704, 3628646, 3628647, 3627516, 3628742, 3628743, 3628744, 3628745, 3628746, 3628693, 3628694, 3628695, 3628696, 3628697, 3628698, 3628792, 3628793, 3628705, 3627458, 3628648, 3628649, 3628650, 3628651, 3628652, 3628653, 3628654, 3628655, 3628656, 3628794, 3628795, 3628796] into oc-m3-release
Change-Id: Ibf3bc3c160288f546d09f9df93a0f0e0878644f0
diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp
index 96a1b35..e80d0e5 100644
--- a/libMpegTPDec/src/tpdec_asc.cpp
+++ b/libMpegTPDec/src/tpdec_asc.cpp
@@ -118,7 +118,9 @@
/*
* Read the extension for height info.
- * return 0 if successfull or -1 if the CRC failed.
+ * return 0 if successfull,
+ * -1 if the CRC failed,
+ * -2 if invalid HeightInfo.
*/
static
int CProgramConfig_ReadHeightExt(
@@ -146,15 +148,21 @@
for (i=0; i < pPce->NumFrontChannelElements; i++)
{
- pPce->FrontElementHeightInfo[i] = (UCHAR) FDKreadBits(bs,2);
+ if ((pPce->FrontElementHeightInfo[i] = (UCHAR) FDKreadBits(bs,2)) >= PC_NUM_HEIGHT_LAYER) {
+ err = -2; /* height information is out of the valid range */
+ }
}
for (i=0; i < pPce->NumSideChannelElements; i++)
{
- pPce->SideElementHeightInfo[i] = (UCHAR) FDKreadBits(bs,2);
+ if ((pPce->SideElementHeightInfo[i] = (UCHAR) FDKreadBits(bs,2)) >= PC_NUM_HEIGHT_LAYER) {
+ err = -2; /* height information is out of the valid range */
+ }
}
for (i=0; i < pPce->NumBackChannelElements; i++)
{
- pPce->BackElementHeightInfo[i] = (UCHAR) FDKreadBits(bs,2);
+ if ((pPce->BackElementHeightInfo[i] = (UCHAR) FDKreadBits(bs,2)) >= PC_NUM_HEIGHT_LAYER) {
+ err = -2; /* height information is out of the valid range */
+ }
}
FDKbyteAlign(bs, alignmentAnchor);
@@ -163,6 +171,13 @@
/* CRC failed */
err = -1;
}
+ if (err!=0) {
+ /* Reset whole height information in case an error occured during parsing. The return
+ value ensures that pPce->isValid is set to 0 and implicit channel mapping is used. */
+ FDKmemclear(pPce->FrontElementHeightInfo, sizeof(pPce->FrontElementHeightInfo));
+ FDKmemclear(pPce->SideElementHeightInfo, sizeof(pPce->SideElementHeightInfo));
+ FDKmemclear(pPce->BackElementHeightInfo, sizeof(pPce->BackElementHeightInfo));
+ }
}
else {
/* No valid extension data found -> restore the initial bitbuffer state */
