Loading media/libstagefright/avc_utils.cpp +16 −4 Original line number Diff line number Diff line Loading @@ -191,10 +191,22 @@ void FindAVCDimensions( frame_crop_top_offset, frame_crop_bottom_offset, cropUnitX, cropUnitY); *width -= (frame_crop_left_offset + frame_crop_right_offset) * cropUnitX; *height -= (frame_crop_top_offset + frame_crop_bottom_offset) * cropUnitY; // *width -= (frame_crop_left_offset + frame_crop_right_offset) * cropUnitX; if(__builtin_add_overflow(frame_crop_left_offset, frame_crop_right_offset, &frame_crop_left_offset) || __builtin_mul_overflow(frame_crop_left_offset, cropUnitX, &frame_crop_left_offset) || __builtin_sub_overflow(*width, frame_crop_left_offset, width) || *width < 0) { *width = 0; } //*height -= (frame_crop_top_offset + frame_crop_bottom_offset) * cropUnitY; if(__builtin_add_overflow(frame_crop_top_offset, frame_crop_bottom_offset, &frame_crop_top_offset) || __builtin_mul_overflow(frame_crop_top_offset, cropUnitY, &frame_crop_top_offset) || __builtin_sub_overflow(*height, frame_crop_top_offset, height) || *height < 0) { *height = 0; } } if (sarWidth != NULL) { Loading Loading
media/libstagefright/avc_utils.cpp +16 −4 Original line number Diff line number Diff line Loading @@ -191,10 +191,22 @@ void FindAVCDimensions( frame_crop_top_offset, frame_crop_bottom_offset, cropUnitX, cropUnitY); *width -= (frame_crop_left_offset + frame_crop_right_offset) * cropUnitX; *height -= (frame_crop_top_offset + frame_crop_bottom_offset) * cropUnitY; // *width -= (frame_crop_left_offset + frame_crop_right_offset) * cropUnitX; if(__builtin_add_overflow(frame_crop_left_offset, frame_crop_right_offset, &frame_crop_left_offset) || __builtin_mul_overflow(frame_crop_left_offset, cropUnitX, &frame_crop_left_offset) || __builtin_sub_overflow(*width, frame_crop_left_offset, width) || *width < 0) { *width = 0; } //*height -= (frame_crop_top_offset + frame_crop_bottom_offset) * cropUnitY; if(__builtin_add_overflow(frame_crop_top_offset, frame_crop_bottom_offset, &frame_crop_top_offset) || __builtin_mul_overflow(frame_crop_top_offset, cropUnitY, &frame_crop_top_offset) || __builtin_sub_overflow(*height, frame_crop_top_offset, height) || *height < 0) { *height = 0; } } if (sarWidth != NULL) { Loading