commit 7a61243f9214290a284f5e8a2adf24603691f064
author Karsten Tausche <karsten@fairphone.com> Wed Jan 20 10:10:27 2021 +0100
committer Karsten Tausche <karsten@fairphone.com> Wed Jan 20 10:10:28 2021 +0100
tree 25900ef1ba2eb36c0822071f0126bbb1d03d1529
parent 907b8ceda69f651fb2ac2f28aaa2e09d5ef5f8d6
parent e2fe966d9d89fc5525ad31eed95518ffaf591c77

Merge the 2021-02-05 SPL branch from AOSP-Partner

* security-aosp-pi-release:
  decoder: Update check for first mb in slice

Change-Id: Ie0883eab764bb1a70a60f7198987d3f06bc7c9b9

decoder/ih264d_parse_slice.c

diff --git a/decoder/ih264d_parse_slice.c b/decoder/ih264d_parse_slice.c
index b477c10..cf2dda9 100644
--- a/decoder/ih264d_parse_slice.c
+++ b/decoder/ih264d_parse_slice.c
@@ -1090,7 +1090,7 @@
     u2_first_mb_in_slice = ih264d_uev(pu4_bitstrm_ofst,
                                      pu4_bitstrm_buf);
     if(u2_first_mb_in_slice
-                    > (ps_dec->u2_frm_ht_in_mbs * ps_dec->u2_frm_wd_in_mbs))
+                    >= (ps_dec->u2_frm_ht_in_mbs * ps_dec->u2_frm_wd_in_mbs))
     {
 
         return ERROR_CORRUPTED_SLICE;