Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-24 21:31:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1334971: P1. Properly handle invalid PPS. r=gerald

Browse Source 
A PPS contains an id that is used as index inside an array. We must ensure that there's enough space in that array.

Also fix H264::DecodePPS which incorrectly always returned an error when parsing a valid PPS.

MozReview-Commit-ID: L1HUAdxWdu0

--HG--
extra : rebase_source : 5e32981d60398d37775573ea17ce54a345401b21
This commit is contained in:
Jean-Yves Avenard 2017-02-07 07:55:19 +01:00
parent 2ce9663a48
commit c51aa799df
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
media/libstagefright/binding/H264.cpp
View File

@ -753,9 +753,12 @@ H264::DecodePPSDataSetFromExtraData(const mozilla::MediaByteBuffer* aExtraData,
}
PPSData ppsData;
if(DecodePPS(pps, aSPSes, ppsData)) {
if (!DecodePPS(pps, aSPSes, ppsData)) {
return false;
}
if (ppsData.pic_parameter_set_id >= aDest.Length()) {
aDest.SetLength(ppsData.pic_parameter_set_id + 1);
}
aDest[ppsData.pic_parameter_set_id] = Move(ppsData);
}
return true;
@ -778,6 +781,10 @@ H264::DecodePPS(const mozilla::MediaByteBuffer* aPPS, const SPSDataSet& aSPSes,
READUE(pic_parameter_set_id, MAX_PPS_COUNT - 1);
READUE(seq_parameter_set_id, MAX_SPS_COUNT - 1);
if (aDest.seq_parameter_set_id >= aSPSes.Length()) {
// Invalid SPS id.
return false;
}
const SPSData& sps = aSPSes[aDest.seq_parameter_set_id];
memcpy(aDest.scaling_matrix4x4, sps.scaling_matrix4x4,