Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ec5e9c0f authored by Pawin Vongmasa's avatar Pawin Vongmasa Committed by android-build-merger
Browse files

h264bsdActivateParamSets: Prevent multiplication overflow. am: 87277aac am:... 

h264bsdActivateParamSets: Prevent multiplication overflow. am: 87277aac am: 2a68d527 am: 5dfa5f26 am: a0bb560e am: 7c22e598 am: 548439e2 am: 4d027a6b am: 177aee1b am: e9bb4f9b
am: 60ab0df3

* commit '60ab0df3':
  h264bsdActivateParamSets: Prevent multiplication overflow.

Change-Id: I714f77542c419fbc58533d3c49e20f593d836607
parents c920b2c2 60ab0df3

media/libstagefright/codecs/on2/h264dec/source/h264bsd_storage.c

+21 −3
Original line number Diff line number Diff line
@@ -58,6 +58,10 @@ 
    3. Module defines

------------------------------------------------------------------------------*/



#ifndef UINT32_MAX

#define UINT32_MAX       (4294967295U)

#endif



/*------------------------------------------------------------------------------

    4. Local function prototypes

------------------------------------------------------------------------------*/
@@ -326,9 +330,23 @@ u32 h264bsdActivateParamSets(storage_t *pStorage, u32 ppsId, u32 isIdr) 
        pStorage->activePps = pStorage->pps[ppsId];

        pStorage->activeSpsId = pStorage->activePps->seqParameterSetId;

        pStorage->activeSps = pStorage->sps[pStorage->activeSpsId];



        /* report error before multiplication to prevent integer overflow */

        if (pStorage->activeSps->picWidthInMbs == 0)

        {

            pStorage->picSizeInMbs = 0;

        }

        else if (pStorage->activeSps->picHeightInMbs >

                 UINT32_MAX / pStorage->activeSps->picWidthInMbs)

        {

            return(MEMORY_ALLOCATION_ERROR);

        }

        else

        {

            pStorage->picSizeInMbs =

                pStorage->activeSps->picWidthInMbs *

                pStorage->activeSps->picHeightInMbs;

        }



        pStorage->currImage->width = pStorage->activeSps->picWidthInMbs;

        pStorage->currImage->height = pStorage->activeSps->picHeightInMbs;