Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a1f181b8 authored by TreeHugger Robot's avatar TreeHugger Robot Committed by Android (Google) Code Review
Browse files

Merge "m4v_h263: Fix heap buffer overflow issue in BitstreamFillCache" into rvc-qpr-dev

parents 7662ea5b 502b917d

media/libstagefright/codecs/m4v_h263/dec/src/bitstream.cpp

+20 −7
Original line number Diff line number Diff line
@@ -649,8 +649,11 @@ PV_STATUS PVSearchNextM4VFrame(BitstreamDecVideo *stream) 






void PVLocateM4VFrameBoundary(BitstreamDecVideo *stream)

PV_STATUS PVLocateM4VFrameBoundary(BitstreamDecVideo *stream)

{

    PV_STATUS status = BitstreamCheckEndBuffer(stream);

    if (status == PV_END_OF_VOP) return status;



    uint8 *ptr;

    int32 byte_pos = (stream->bitcnt >> 3);
@@ -658,10 +661,14 @@ void PVLocateM4VFrameBoundary(BitstreamDecVideo *stream) 
    ptr = stream->bitstreamBuffer + byte_pos;



    stream->data_end_pos = PVLocateFrameHeader(ptr, (int32)stream->data_end_pos - byte_pos) + byte_pos;

    return PV_SUCCESS;

}



void PVLocateH263FrameBoundary(BitstreamDecVideo *stream)

PV_STATUS PVLocateH263FrameBoundary(BitstreamDecVideo *stream)

{

    PV_STATUS status = BitstreamCheckEndBuffer(stream);

    if (status == PV_END_OF_VOP) return status;



    uint8 *ptr;

    int32 byte_pos = (stream->bitcnt >> 3);
@@ -669,6 +676,7 @@ void PVLocateH263FrameBoundary(BitstreamDecVideo *stream) 
    ptr = stream->bitstreamBuffer + byte_pos;



    stream->data_end_pos = PVLocateH263FrameHeader(ptr, (int32)stream->data_end_pos - byte_pos) + byte_pos;

    return PV_SUCCESS;

}



/* ======================================================================== */
@@ -687,7 +695,8 @@ PV_STATUS quickSearchVideoPacketHeader(BitstreamDecVideo *stream, int marker_len 


    if (stream->searched_frame_boundary == 0)

    {

        PVLocateM4VFrameBoundary(stream);

        status = PVLocateM4VFrameBoundary(stream);

        if (status != PV_SUCCESS) return status;

    }



    do
@@ -711,7 +720,8 @@ PV_STATUS quickSearchH263SliceHeader(BitstreamDecVideo *stream) 


    if (stream->searched_frame_boundary == 0)

    {

        PVLocateH263FrameBoundary(stream);

        status = PVLocateH263FrameBoundary(stream);

        if (status != PV_SUCCESS) return status;

    }



    do
@@ -789,7 +799,8 @@ PV_STATUS quickSearchMotionMarker(BitstreamDecVideo *stream) 


    if (stream->searched_frame_boundary == 0)

    {

        PVLocateM4VFrameBoundary(stream);

        status = PVLocateM4VFrameBoundary(stream);

        if (status != PV_SUCCESS) return status;

    }



    while (TRUE)
@@ -880,7 +891,8 @@ PV_STATUS quickSearchDCM(BitstreamDecVideo *stream) 


    if (stream->searched_frame_boundary == 0)

    {

        PVLocateM4VFrameBoundary(stream);

        status = PVLocateM4VFrameBoundary(stream);

        if (status != PV_SUCCESS) return status;

    }



    while (TRUE)
@@ -956,7 +968,8 @@ PV_STATUS quickSearchGOBHeader(BitstreamDecVideo *stream) 


    if (stream->searched_frame_boundary == 0)

    {

        PVLocateH263FrameBoundary(stream);

        status = PVLocateH263FrameBoundary(stream);

        if (status != PV_SUCCESS) return status;

    }



    while (TRUE)

media/libstagefright/codecs/m4v_h263/dec/src/bitstream.h

+2 −2
Original line number Diff line number Diff line
@@ -156,8 +156,8 @@ extern "C" 




    /* for error concealment & soft-decoding */

    void PVLocateM4VFrameBoundary(BitstreamDecVideo *stream);

    void PVSearchH263FrameBoundary(BitstreamDecVideo *stream);

    PV_STATUS PVLocateM4VFrameBoundary(BitstreamDecVideo *stream);

    PV_STATUS PVSearchH263FrameBoundary(BitstreamDecVideo *stream);



    PV_STATUS quickSearchMotionMarker(BitstreamDecVideo *stream);

    PV_STATUS quickSearchDCM(BitstreamDecVideo *stream);