Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 68b930c2 authored by Marco Nelissen's avatar Marco Nelissen
Browse files

Fix integer overflow abort 

Bug: 33137739
Test: manual
Change-Id: Ic4b6baebc22e101a4a57387b5b97ae3a5e30fd98
parent 809ea9d9

media/libstagefright/avc_utils.cpp

+16 −4
Original line number Diff line number Diff line
@@ -191,10 +191,22 @@ void FindAVCDimensions( 
             frame_crop_top_offset, frame_crop_bottom_offset,

             cropUnitX, cropUnitY);



        *width -=

            (frame_crop_left_offset + frame_crop_right_offset) * cropUnitX;

        *height -=

            (frame_crop_top_offset + frame_crop_bottom_offset) * cropUnitY;



        // *width -= (frame_crop_left_offset + frame_crop_right_offset) * cropUnitX;

        if(__builtin_add_overflow(frame_crop_left_offset, frame_crop_right_offset, &frame_crop_left_offset) ||

            __builtin_mul_overflow(frame_crop_left_offset, cropUnitX, &frame_crop_left_offset) ||

            __builtin_sub_overflow(*width, frame_crop_left_offset, width) ||

            *width < 0) {

            *width = 0;

        }



        //*height -= (frame_crop_top_offset + frame_crop_bottom_offset) * cropUnitY;

        if(__builtin_add_overflow(frame_crop_top_offset, frame_crop_bottom_offset, &frame_crop_top_offset) ||

            __builtin_mul_overflow(frame_crop_top_offset, cropUnitY, &frame_crop_top_offset) ||

            __builtin_sub_overflow(*height, frame_crop_top_offset, height) ||

            *height < 0) {

            *height = 0;

        }

    }



    if (sarWidth != NULL) {