Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5ae4f028 authored by Marco Nelissen's avatar Marco Nelissen Committed by android-build-merger
Browse files

[automerger] Fix OOB access in mpeg4/h263 decoder am: ef4ce157 am:... 

[automerger] Fix OOB access in mpeg4/h263 decoder am: ef4ce157 am: 9832a2a3 am: 144ba691 am: 6fa588c7 am: 88c0c489 am: efd8f9e0 am: e545f3c8 am: 6cf42dba am: 874ec86e
am: ddf94140

Change-Id: I281afc1d7a4e2acf783505b3061dd4afd274e328
parents 44302851 ddf94140

media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp

+8 −0
Original line number Diff line number Diff line
@@ -1355,6 +1355,14 @@ PV_STATUS DecodeShortHeader(VideoDecData *video, Vop *currVop) 
            int tmpHeight = (tmpDisplayHeight + 15) & -16;

            int tmpWidth = (tmpDisplayWidth + 15) & -16;



            if (tmpWidth > video->width)

            {

                // while allowed by the spec, this decoder does not actually

                // support an increase in size.

                ALOGE("width increase not supported");

                status = PV_FAIL;

                goto return_point;

            }

            if (tmpHeight * tmpWidth > video->size)

            {

                // This is just possibly "b/37079296".