@@ -1670,18 +1670,22 @@ static int dec_tile_comp(oapvd_tile_t *tile, oapvd_ctx_t *ctx, oapvd_core_t *cor
16701670
16711671 /* byte align */
16721672 oapv_bsr_align8 (bs );
1673+ /* check actual read size of 'tile()' is equal or smaller than 'tile_data_size' in tile header */
1674+ oapv_assert_rv (BSR_GET_READ_BYTE (bs ) <= tile -> th .tile_data_size [c ], OAPV_ERR_MALFORMED_BITSTREAM );
1675+
16731676 return OAPV_OK ;
16741677}
16751678
16761679static int dec_tile (oapvd_core_t * core , oapvd_tile_t * tile )
16771680{
16781681 int ret , midx , x , y , c ;
16791682 oapvd_ctx_t * ctx = core -> ctx ;
1680- oapv_bs_t bs ;
1683+ oapv_bs_t bs ; // bs for 'tile()' syntax
16811684
16821685 oapv_bsr_init (& bs , tile -> bs_beg + OAPV_TILE_SIZE_LEN , tile -> data_size , NULL );
16831686 ret = oapvd_vlc_tile_header (& bs , ctx , & tile -> th );
16841687 oapv_assert_rv (OAPV_SUCCEEDED (ret ), ret );
1688+
16851689 for (c = 0 ; c < ctx -> num_comp ; c ++ ) {
16861690 core -> qp [c ] = tile -> th .tile_qp [c ];
16871691 int dq_scale = oapv_tbl_dq_scale [core -> qp [c ] % 6 ];
@@ -1702,6 +1706,9 @@ static int dec_tile(oapvd_core_t *core, oapvd_tile_t *tile)
17021706 for (c = 0 ; c < ctx -> num_comp ; c ++ ) {
17031707 int tc , s_dst ;
17041708 s16 * dst ;
1709+ oapv_bs_t bsc ; // bs for 'tile_data()' syntax
1710+
1711+ oapv_bsr_init (& bsc , BSR_GET_CUR (& bs ), tile -> th .tile_data_size [c ], NULL );
17051712
17061713 if (OAPV_CS_GET_FORMAT (ctx -> imgb -> cs ) == OAPV_CF_PLANAR2 ) {
17071714 tc = c > 0 ? 1 : 0 ;
@@ -1714,8 +1721,11 @@ static int dec_tile(oapvd_core_t *core, oapvd_tile_t *tile)
17141721 s_dst = ctx -> imgb -> s [c ];
17151722 }
17161723
1717- ret = dec_tile_comp (tile , ctx , core , & bs , c , s_dst , dst );
1724+ ret = dec_tile_comp (tile , ctx , core , & bsc , c , s_dst , dst );
17181725 oapv_assert_rv (OAPV_SUCCEEDED (ret ), ret );
1726+
1727+ // move bs buffer to next 'tile_data()' component
1728+ BSR_MOVE_BYTE_ALIGN (& bs , tile -> th .tile_data_size [c ]);
17191729 }
17201730
17211731 oapvd_vlc_tile_dummy_data (& bs );
0 commit comments