commit 1f23b0bad13a047167910419b34dbad8b17a2eac
author android-build-team Robot <android-build-team-robot@google.com> Thu Feb 08 04:16:46 2018 +0000
committer android-build-team Robot <android-build-team-robot@google.com> Thu Feb 08 04:16:46 2018 +0000
tree 014b598bf70d7302655354e705b254cdd3af4793
parent 9ca83ea75d0ad69d7ea57bcddd4af1e422f0b978
parent 1b9cbed05b4fd376677d67b6442aa30256834ed4

Merge cherrypicks of [3581037, 3581038, 3580473, 3580624, 3580656, 3580657, 3580658, 3580382, 3580474, 3580475, 3581039, 3581040, 3580476, 3580206, 3581527, 3580955, 3580956, 3580957, 3580958, 3580959, 3580960, 3580961, 3580962, 3580963, 3580964, 3580965, 3580966, 3581567, 3581568, 3581569, 3581570, 3581571, 3580625, 3580626, 3581587, 3581513, 3581514, 3581515, 3580477, 3581588, 3580659, 3580660, 3580383, 3580384, 3580478, 3580719, 3580479, 3580480, 3581385, 3581528, 3581041, 3581042, 3581043, 3581044, 3581045, 3581046, 3581607, 3580385, 3580481, 3580482, 3580483, 3580661, 3580662, 3580663, 3580664, 3580665, 3580484, 3580485, 3581608, 3581609, 3581610, 3581611, 3581612, 3581589, 3581613, 3580486, 3581519, 3581627, 3581628, 3581529, 3581530, 3581531, 3581629, 3581630] into oc-mr1-release

Change-Id: If20fd2e8daec515d40ca1017e9ada98e1d389144

libMpegTPDec/src/tpdec_asc.cpp

diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp
index 96a1b35..e80d0e5 100644
--- a/libMpegTPDec/src/tpdec_asc.cpp
+++ b/libMpegTPDec/src/tpdec_asc.cpp
@@ -118,7 +118,9 @@
 
 /*
  * Read the extension for height info.
- * return 0 if successfull or -1 if the CRC failed.
+ * return 0 if successfull,
+ *       -1 if the CRC failed,
+ *       -2 if invalid HeightInfo.
  */
 static
 int CProgramConfig_ReadHeightExt(
@@ -146,15 +148,21 @@
 
     for (i=0; i < pPce->NumFrontChannelElements; i++)
     {
-      pPce->FrontElementHeightInfo[i] = (UCHAR) FDKreadBits(bs,2);
+      if ((pPce->FrontElementHeightInfo[i] = (UCHAR) FDKreadBits(bs,2)) >= PC_NUM_HEIGHT_LAYER) {
+        err = -2; /* height information is out of the valid range */
+      }
     }
     for (i=0; i < pPce->NumSideChannelElements; i++)
     {
-      pPce->SideElementHeightInfo[i] = (UCHAR) FDKreadBits(bs,2);
+      if ((pPce->SideElementHeightInfo[i] = (UCHAR) FDKreadBits(bs,2)) >= PC_NUM_HEIGHT_LAYER) {
+        err = -2; /* height information is out of the valid range */
+      }
     }
     for (i=0; i < pPce->NumBackChannelElements; i++)
     {
-      pPce->BackElementHeightInfo[i] = (UCHAR) FDKreadBits(bs,2);
+      if ((pPce->BackElementHeightInfo[i] = (UCHAR) FDKreadBits(bs,2)) >= PC_NUM_HEIGHT_LAYER) {
+        err = -2; /* height information is out of the valid range */
+      }
     }
     FDKbyteAlign(bs, alignmentAnchor);
 
@@ -163,6 +171,13 @@
       /* CRC failed */
       err = -1;
     }
+    if (err!=0) {
+      /* Reset whole height information in case an error occured during parsing. The return
+         value ensures that pPce->isValid is set to 0 and implicit channel mapping is used. */
+      FDKmemclear(pPce->FrontElementHeightInfo, sizeof(pPce->FrontElementHeightInfo));
+      FDKmemclear(pPce->SideElementHeightInfo, sizeof(pPce->SideElementHeightInfo));
+      FDKmemclear(pPce->BackElementHeightInfo, sizeof(pPce->BackElementHeightInfo));
+    }
   }
   else {
     /* No valid extension data found -> restore the initial bitbuffer state */