diff options
| author | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | 2016-12-23 15:29:14 +0530 |
|---|---|---|
| committer | Sean McCreary <mccreary@mcwest.org> | 2017-04-05 19:13:25 -0600 |
| commit | ec95770c24088ba5fc5c21aa9c28a588970aad46 (patch) | |
| tree | 7657083139f6b1e18e45582282f7052f2fff8cae /decoder/ih264d_function_selector.h | |
| parent | 063772f112715b8a9bc4710a57fbb4449da50ee4 (diff) | |
| download | android_external_libavc-ec95770c24088ba5fc5c21aa9c28a588970aad46.tar.gz android_external_libavc-ec95770c24088ba5fc5c21aa9c28a588970aad46.tar.bz2 android_external_libavc-ec95770c24088ba5fc5c21aa9c28a588970aad46.zip | |
Decoder: Fixes an out of bound write in bitstream buffer
[for mnc-dr-dev and later; mnc-dev gets a different patch]
After emulation prevention, data is written as an int,
so at least 3 additional bytes should be available.
And since bitstream functions read 8 bytes ahead, 8 extra bytes
should be available in the bitstream buffer.
Bug: 33934721
AOSP-Change-Id: I444ec6f85d01b0bade9f827e15c4b476779d6c69
CVE-2017-0542
Change-Id: I3c77857dc558b2ab0bacbfae0c56e794154bd50c
(cherry picked from commit 33ef7de9ddc8ea7eb9cbc440d1cf89957a0c267b)
Diffstat (limited to 'decoder/ih264d_function_selector.h')
0 files changed, 0 insertions, 0 deletions