Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9eba75b4 authored by TreeHugger Robot's avatar TreeHugger Robot Committed by Automerger Merge Worker
Browse files

Merge "FrameDecoder:Handle grid vars multiply overflow" into sc-v2-dev am: 9092ee66 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/15895509

Change-Id: I4e0b7a8c9937dbded5037794bd7204037b19f433
parents 0dbc762d 9092ee66

media/libstagefright/FrameDecoder.cpp

+9 −1
Original line number Diff line number Diff line
@@ -793,8 +793,16 @@ sp<AMessage> MediaImageDecoder::onGetFormatAndSeekOptions( 
    if (overrideMeta == NULL) {

        // check if we're dealing with a tiled heif

        int32_t tileWidth, tileHeight, gridRows, gridCols;

        int32_t widthColsProduct = 0;

        int32_t heightRowsProduct = 0;

        if (findGridInfo(trackMeta(), &tileWidth, &tileHeight, &gridRows, &gridCols)) {

            if (mWidth <= tileWidth * gridCols && mHeight <= tileHeight * gridRows) {

            if (__builtin_mul_overflow(tileWidth, gridCols, &widthColsProduct) ||

                    __builtin_mul_overflow(tileHeight, gridRows, &heightRowsProduct)) {

                ALOGE("Multiplication overflowed Grid size: %dx%d, Picture size: %dx%d",

                        gridCols, gridRows, tileWidth, tileHeight);

                return nullptr;

            }

            if (mWidth <= widthColsProduct && mHeight <= heightRowsProduct) {

                ALOGV("grid: %dx%d, tile size: %dx%d, picture size: %dx%d",

                        gridCols, gridRows, tileWidth, tileHeight, mWidth, mHeight);