Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 34272233 authored by Wei Jia's avatar Wei Jia Committed by Android Git Automerger
Browse files

am 3dcb448f: am 4bb01def: am 84a4221e: am a9b3cd3c: am 5221133b: am b2ae4351:... 

am 3dcb448f: am 4bb01def: am 84a4221e: am a9b3cd3c: am 5221133b: am b2ae4351: libstagefright: fix overflow in pvdec_api.cpp.

* commit '3dcb448f':
  libstagefright: fix overflow in pvdec_api.cpp.
parents dbdcecd6 3dcb448f

media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp

+2 −2
Original line number Diff line number Diff line
@@ -343,7 +343,7 @@ Bool PVAllocVideoData(VideoDecControls *decCtrl, int width, int height, int nLay 
    video->prevVop->uChan = video->prevVop->yChan + size;

    video->prevVop->vChan = video->prevVop->uChan + (size >> 2);

#else

    if (size > INT32_MAX / 3 * 2) {

    if (size > INT32_MAX / 3) {

        return PV_FALSE;

    }

    video->currVop->yChan = (PIXEL *) oscl_malloc(size * 3 / 2); /* Allocate memory for all VOP OKA 3/2/1*/
@@ -373,7 +373,7 @@ Bool PVAllocVideoData(VideoDecControls *decCtrl, int width, int height, int nLay 
        {

            oscl_memset(video->prevEnhcVop, 0, sizeof(Vop));

#ifndef PV_MEMORY_POOL

            if (size > INT32_MAX / 3 * 2) {

            if (size > INT32_MAX / 3) {

                return PV_FALSE;

            }