Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a8a69049 authored by Marco Nelissen's avatar Marco Nelissen Committed by android-build-merger
Browse files

Merge "Fix integer overflow abort" am: 768a06e9 

am: 036e6fd4

Change-Id: I7b48b0cc2c06b4b06d314c060fc98f37a6879728
parents 5ed0e52e 036e6fd4

media/libstagefright/avc_utils.cpp

+16 −4
Original line number Diff line number Diff line
@@ -200,10 +200,22 @@ void FindAVCDimensions( 
             frame_crop_top_offset, frame_crop_bottom_offset,

             cropUnitX, cropUnitY);



        *width -=

            (frame_crop_left_offset + frame_crop_right_offset) * cropUnitX;

        *height -=

            (frame_crop_top_offset + frame_crop_bottom_offset) * cropUnitY;



        // *width -= (frame_crop_left_offset + frame_crop_right_offset) * cropUnitX;

        if(__builtin_add_overflow(frame_crop_left_offset, frame_crop_right_offset, &frame_crop_left_offset) ||

            __builtin_mul_overflow(frame_crop_left_offset, cropUnitX, &frame_crop_left_offset) ||

            __builtin_sub_overflow(*width, frame_crop_left_offset, width) ||

            *width < 0) {

            *width = 0;

        }



        //*height -= (frame_crop_top_offset + frame_crop_bottom_offset) * cropUnitY;

        if(__builtin_add_overflow(frame_crop_top_offset, frame_crop_bottom_offset, &frame_crop_top_offset) ||

            __builtin_mul_overflow(frame_crop_top_offset, cropUnitY, &frame_crop_top_offset) ||

            __builtin_sub_overflow(*height, frame_crop_top_offset, height) ||

            *height < 0) {

            *height = 0;

        }

    }



    if (sarWidth != NULL) {