Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit cbcfaedc authored by Kevin F. Haggerty's avatar Kevin F. Haggerty
Browse files

Merge tag 'android-8.1.0_r69' into staging/lineage-15.1_merge-android-8.1.0_r69 

Android 8.1.0 Release 69 (5794017)

* tag 'android-8.1.0_r69': (58 commits)
  Fix OOB access in mpeg4/h263 decoder
  m4v_h263: add a test for invalid/negative value
  AMR WB encoder: prevent OOB write in ACELP_4t64_fx
  httplive: detect oom if playlist is infinite
  Fix overflow/dos in 3gg text description parsing
  DO NOT MERGE: audiopolicy: Remove raw pointer references to AudioMix
  Zero-initialize HIDL structs before passing
  Remove unused AVIExtractor source
  NuPlayerCCDecoder: fix memory OOB
  audio: ensure effect chain with specific session id is unique
  AudioFlinger: Prevent multiple effect chains with same sessionId
  Reserve enough space for RTSP CSD
  AudioFlinger: put effect desc lookup under mutex for createEffect
  RESTRICT AUTOMERGE: aaudio: improve test_atomic_fifo
  RESTRICT AUTOMERGE: aaudio: Fix converting negative FIFO counters to index
  RESTRICT AUTOMERGE: aaudio: fix FIFO wrapround frame counts
  CTS error while media dump()
  MediaExtractor: stop rendering when an error occurs
  Fix race condition for cas sessions -- DO NOT MERGE
  Check for overflow of crypto size
  ...

Change-Id: I866820601c6bfd6e3fd4b44ccf98e38f4b265750
parents ffbc98b7 4d1c89b8

media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp

+5 −1
Original line number Diff line number Diff line
@@ -52,7 +52,11 @@ PV_STATUS PV_ReadVideoPacketHeader(VideoDecData *video, int *next_MB) 
        PV_BitstreamByteAlign(stream);

        BitstreamReadBits32(stream, resync_marker_length);



        *next_MB = (int) BitstreamReadBits16(stream, nbits);

        int mbnum = (int) BitstreamReadBits16(stream, nbits);

        if (mbnum < 0) {

            return PV_FAIL;

        }

        *next_MB = mbnum;

//      if (*next_MB <= video->mbnum)   /*  needs more investigation */

//          *next_MB = video->mbnum+1;

media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp

+8 −0
Original line number Diff line number Diff line
@@ -1355,6 +1355,14 @@ PV_STATUS DecodeShortHeader(VideoDecData *video, Vop *currVop) 
            int tmpHeight = (tmpDisplayHeight + 15) & -16;

            int tmpWidth = (tmpDisplayWidth + 15) & -16;



            if (tmpWidth > video->width)

            {

                // while allowed by the spec, this decoder does not actually

                // support an increase in size.

                ALOGE("width increase not supported");

                status = PV_FAIL;

                goto return_point;

            }

            if (tmpHeight * tmpWidth > video->size)

            {

                // This is just possibly "b/37079296".