Merge cherrypicks of [2780919, 2780841, 2780458, 2780892, 2780893, 2781183, 2781184, 2780842, 2780843, 2780920, 2780921, 2780922, 2780923, 2780924, 2780925, 2780926, 2780927, 2780894, 2780895, 2781304, 2780844, 2780845, 2780846, 2781209] into nyc-mr1-security-e-releaseandroid-7.1.1_r55nougat-mr1.5-release

Change-Id: I0553dda90b95d3723aafb29902e366eeffc7dae1

2 files changed, 13 insertions, 1 deletions

diff --git a/decoder/ihevcd_decode.c b/decoder/ihevcd_decode.c
index 87c3bd7..7b82e84 100644
--- a/decoder/ihevcd_decode.c
+++ b/decoder/ihevcd_decode.c
@@ -633,7 +633,6 @@ WORD32 ihevcd_decode(iv_obj_t *ps_codec_obj, void *pv_api_ip, void *pv_api_op)
 
         if(IHEVCD_IGNORE_SLICE == ret)
         {
-            ps_codec->s_parse.i4_cur_slice_idx = MAX(0, (ps_codec->s_parse.i4_cur_slice_idx - 1));
             ps_codec->pu1_inp_bitsbuf += (nal_ofst + nal_len);
             ps_codec->i4_bytes_remaining -= (nal_ofst + nal_len);
 
diff --git a/decoder/ihevcd_parse_headers.c b/decoder/ihevcd_parse_headers.c
index 29a309d..06f35a3 100644
--- a/decoder/ihevcd_parse_headers.c
+++ b/decoder/ihevcd_parse_headers.c
@@ -1813,6 +1813,19 @@ IHEVCD_ERROR_T ihevcd_parse_pps(codec_t *ps_codec)
     BITS_PARSE("tiles_enabled_flag", value, ps_bitstrm, 1);
     ps_pps->i1_tiles_enabled_flag = value;
 
+    /* When tiles are enabled and width or height is >= 4096,
+     * CTB Size should at least be 32. 16x16 CTBs can result
+     * in tile position greater than 255 for 4096,
+     * which decoder does not support.
+     */
+    if((ps_pps->i1_tiles_enabled_flag) &&
+                    (ps_sps->i1_log2_ctb_size == 4) &&
+                    ((ps_sps->i2_pic_width_in_luma_samples >= 4096) ||
+                    (ps_sps->i2_pic_height_in_luma_samples >= 4096)))
+    {
+        return IHEVCD_INVALID_HEADER;
+    }
+
     BITS_PARSE("entropy_coding_sync_enabled_flag", value, ps_bitstrm, 1);
     ps_pps->i1_entropy_coding_sync_enabled_flag = value;