Code: IHEVCD_ERROR_T ihevcd_cabac_init(cab_ctxt_t *ps_cabac,
 bitstrm_t *ps_bitstrm,
                                 WORD32 qp,
                                 WORD32 cabac_init_idc,
 const UWORD8 *pu1_init_ctxt)
{
 /* Sanity checks */
    ASSERT(ps_cabac != NULL);
    ASSERT(ps_bitstrm != NULL);
    ASSERT((qp >= 0) && (qp < 52));
    ASSERT((cabac_init_idc >= 0) && (cabac_init_idc < 3));
    UNUSED(qp);
    UNUSED(cabac_init_idc);
 /* CABAC engine uses 32 bit range instead of 9 bits as specified by
     * the spec. This is done to reduce number of renormalizations
     */
 /* cabac engine initialization */
#if FULLRANGE
    ps_cabac->u4_range = (UWORD32)510 << RANGE_SHIFT;
    BITS_GET(ps_cabac->u4_ofst, ps_bitstrm->pu4_buf, ps_bitstrm->u4_bit_ofst,
                    ps_bitstrm->u4_cur_word, ps_bitstrm->u4_nxt_word, (9 + RANGE_SHIFT));

#else
    ps_cabac->u4_range = (UWORD32)510;
    BITS_GET(ps_cabac->u4_ofst, ps_bitstrm->pu4_buf, ps_bitstrm->u4_bit_ofst,
                    ps_bitstrm->u4_cur_word, ps_bitstrm->u4_nxt_word, 9);

#endif

 /* cabac context initialization based on init idc and slice qp */
    memcpy(ps_cabac->au1_ctxt_models,

            pu1_init_ctxt,
            IHEVC_CAB_CTXT_END);
     DEBUG_RANGE_OFST("init", ps_cabac->u4_range, ps_cabac->u4_ofst);
     return ((IHEVCD_ERROR_T)IHEVCD_SUCCESS);
 }

Vulnerability Type: Exec Code Overflow Mem. Corr. 
CWE ID: CWE-119
Summary: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34897036.
Commit Message: Return error from cabac init if offset is greater than range

When the offset was greater than range, the bitstream was read
more than the valid range in leaf-level cabac parsing modules.
Error check was added to cabac init to fix this issue. Additionally
end of slice and slice error were signalled to suppress further
parsing of current slice.

Bug: 34897036
Change-Id: I1263f1d1219684ffa6e952c76e5a08e9a933c9d2
(cherry picked from commit 3b175da88a1807d19cdd248b74bce60e57f05c6a)
(cherry picked from commit b92314c860d01d754ef579eafe55d7377962b3ba)
