Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4c3c2ecc authored by Krishnankutty Kolathappilly's avatar Krishnankutty Kolathappilly Committed by Arne Coucheron
Browse files

libstagefright: Fix crash in AVCDecoder during thumbnail creation. 

-AVCDecoder reads the sequence parameter set values from the
 sequence parameter set id zero. The clip has valid sequence
 parameter set data at sequence parameter set id one.
-Invalid data at id zero causes NULL dereference and crash.
-Add fix to return error if sequence parameter set data at id
 zero points to invalid data.

Change-Id: If9b4507242f7ea0127f75a6957d8ad73b91ce6fa
CRs-Fixed: 284889
parent ede89893

media/libstagefright/codecs/avc/dec/AVCDecoder.cpp

+4 −1
Original line number Diff line number Diff line
@@ -384,7 +384,10 @@ status_t AVCDecoder::read( 
                }



                AVCDecObject *pDecVid = (AVCDecObject *)mHandle->AVCObject;



                if(pDecVid->seqParams[0] == NULL) {

                    LOGE("Sequence Parameter set at id 0 is invalid");

                    break;

                }

                int32_t width =

                    (pDecVid->seqParams[0]->pic_width_in_mbs_minus1 + 1) * 16;