Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e358e219 authored by Marco Nelissen's avatar Marco Nelissen Committed by android-build-merger
Browse files

Fix potential overflow am: d0090759 am: f5d9360b am: 08cb8520 am:... 

Fix potential overflow am: d0090759 am: f5d9360b am: 08cb8520 am: 20062e9e am: 999c3ea2 am: 7f4bf86a am: 356a30b4 am: 9da2f9de am: 24a01b29 am: aae6e3a4
am: 6b478e2c

Change-Id: I8de38ccee100e5f363292f24c8375e05726a154d
parents 247a92ee 6b478e2c

media/libstagefright/codecs/on2/h264dec/source/h264bsd_dpb.c

+8 −0
Original line number Original line Diff line number Diff line
@@ -60,6 +60,7 @@ 
#include "h264bsd_util.h"

#include "h264bsd_util.h"

#include "basetype.h"

#include "basetype.h"





#include <log/log.h>

/*------------------------------------------------------------------------------

/*------------------------------------------------------------------------------

    2. External compiler flags

    2. External compiler flags

--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
@@ -998,6 +999,13 @@ u32 h264bsdInitDpb( 
    ASSERT(maxFrameNum);

    ASSERT(maxFrameNum);

    ASSERT(dpbSize);

    ASSERT(dpbSize);





    // see comment in loop below about size calculation

    if (picSizeInMbs > (UINT32_MAX - 32 - 15) / 384) {

        ALOGE("b/28533562");

        android_errorWriteLog(0x534e4554, "28533562");

        return(MEMORY_ALLOCATION_ERROR);

    }



    dpb->maxLongTermFrameIdx = NO_LONG_TERM_FRAME_INDICES;

    dpb->maxLongTermFrameIdx = NO_LONG_TERM_FRAME_INDICES;

    dpb->maxRefFrames        = MAX(maxRefFrames, 1);

    dpb->maxRefFrames        = MAX(maxRefFrames, 1);

    if (noReordering)

    if (noReordering)