Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2a68d527 authored by Pawin Vongmasa's avatar Pawin Vongmasa Committed by android-build-merger
Browse files

h264bsdActivateParamSets: Prevent multiplication overflow. 

am: 87277aac

* commit '87277aac':
  h264bsdActivateParamSets: Prevent multiplication overflow.

Change-Id: I87166daa0493721d44a10531466b59080b65f153
parents 4b817b51 87277aac

media/libstagefright/codecs/on2/h264dec/source/h264bsd_storage.c

+21 −3
Original line number Diff line number Diff line
@@ -58,6 +58,10 @@ 
    3. Module defines

------------------------------------------------------------------------------*/



#ifndef UINT32_MAX

#define UINT32_MAX       (4294967295U)

#endif



/*------------------------------------------------------------------------------

    4. Local function prototypes

------------------------------------------------------------------------------*/
@@ -326,9 +330,23 @@ u32 h264bsdActivateParamSets(storage_t *pStorage, u32 ppsId, u32 isIdr) 
        pStorage->activePps = pStorage->pps[ppsId];

        pStorage->activeSpsId = pStorage->activePps->seqParameterSetId;

        pStorage->activeSps = pStorage->sps[pStorage->activeSpsId];



        /* report error before multiplication to prevent integer overflow */

        if (pStorage->activeSps->picWidthInMbs == 0)

        {

            pStorage->picSizeInMbs = 0;

        }

        else if (pStorage->activeSps->picHeightInMbs >

                 UINT32_MAX / pStorage->activeSps->picWidthInMbs)

        {

            return(MEMORY_ALLOCATION_ERROR);

        }

        else

        {

            pStorage->picSizeInMbs =

                pStorage->activeSps->picWidthInMbs *

                pStorage->activeSps->picHeightInMbs;

        }



        pStorage->currImage->width = pStorage->activeSps->picWidthInMbs;

        pStorage->currImage->height = pStorage->activeSps->picHeightInMbs;