Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 036e6fd4 authored by Marco Nelissen's avatar Marco Nelissen Committed by android-build-merger
Browse files

Merge "Fix integer overflow abort" 

am: 768a06e9

Change-Id: I1b3ecfec01fefb6d065a302cf8d663731a20d45e
parents 09a36e5d 768a06e9

media/libstagefright/avc_utils.cpp

+16 −4
Original line number Diff line number Diff line
@@ -200,10 +200,22 @@ void FindAVCDimensions( 
             frame_crop_top_offset, frame_crop_bottom_offset,

             cropUnitX, cropUnitY);



        *width -=

            (frame_crop_left_offset + frame_crop_right_offset) * cropUnitX;

        *height -=

            (frame_crop_top_offset + frame_crop_bottom_offset) * cropUnitY;



        // *width -= (frame_crop_left_offset + frame_crop_right_offset) * cropUnitX;

        if(__builtin_add_overflow(frame_crop_left_offset, frame_crop_right_offset, &frame_crop_left_offset) ||

            __builtin_mul_overflow(frame_crop_left_offset, cropUnitX, &frame_crop_left_offset) ||

            __builtin_sub_overflow(*width, frame_crop_left_offset, width) ||

            *width < 0) {

            *width = 0;

        }



        //*height -= (frame_crop_top_offset + frame_crop_bottom_offset) * cropUnitY;

        if(__builtin_add_overflow(frame_crop_top_offset, frame_crop_bottom_offset, &frame_crop_top_offset) ||

            __builtin_mul_overflow(frame_crop_top_offset, cropUnitY, &frame_crop_top_offset) ||

            __builtin_sub_overflow(*height, frame_crop_top_offset, height) ||

            *height < 0) {

            *height = 0;

        }

    }



    if (sarWidth != NULL) {