From 06ecaa36d050866b2f0f29864b3e69b9970e9980 Mon Sep 17 00:00:00 2001
From: Chris Craik <ccraik@google.com>
Date: Wed, 16 Nov 2016 10:33:54 -0800
Subject: resolve merge conflicts of 3802db4 to mnc-dev

bug:32338390
Change-Id: I304c0c8c646808e690918eae7d34f0852e2b0fa8
(cherry picked from commit fffaa9f25edddc6fa10512c1cc19f625c2abee8c)
(cherry picked from commit 7f0e3dab5a892228d8dead7f0221cc9ae82474f7)
---
 framesequence/jni/FrameSequence_webp.cpp | 12 ++++++++++--
 framesequence/jni/FrameSequence_webp.h   |  9 +++++++++
 2 files changed, 19 insertions(+), 2 deletions(-)

(limited to 'framesequence')

diff --git a/framesequence/jni/FrameSequence_webp.cpp b/framesequence/jni/FrameSequence_webp.cpp
index c33a7e2..034847a 100644
--- a/framesequence/jni/FrameSequence_webp.cpp
+++ b/framesequence/jni/FrameSequence_webp.cpp
@@ -84,7 +84,10 @@ void FrameSequence_webp::constructDependencyChain() {
 #endif
 }
 
-FrameSequence_webp::FrameSequence_webp(Stream* stream) {
+FrameSequence_webp::FrameSequence_webp(Stream* stream)
+        : mDemux(NULL)
+        , mIsKeyFrame(NULL)
+        , mRawByteBuffer(NULL) {
     if (stream->getRawBuffer() != NULL) {
         mData.size = stream->getRawBufferSize();
         mData.bytes = stream->getRawBufferAddr();
@@ -96,7 +99,12 @@ FrameSequence_webp::FrameSequence_webp(Stream* stream) {
             ALOGE("WebP header load failed");
             return;
         }
-        mData.size = CHUNK_HEADER_SIZE + GetLE32(riff_header + TAG_SIZE);
+        uint32_t readSize = GetLE32(riff_header + TAG_SIZE);
+        if (readSize > MAX_CHUNK_PAYLOAD) {
+            ALOGE("WebP got header size too large");
+            return;
+        }
+        mData.size = CHUNK_HEADER_SIZE + readSize;
         mData.bytes = new uint8_t[mData.size];
         memcpy((void*)mData.bytes, riff_header, RIFF_HEADER_SIZE);
 
diff --git a/framesequence/jni/FrameSequence_webp.h b/framesequence/jni/FrameSequence_webp.h
index 94dcc3b..a29574c 100644
--- a/framesequence/jni/FrameSequence_webp.h
+++ b/framesequence/jni/FrameSequence_webp.h
@@ -32,10 +32,16 @@ public:
     virtual ~FrameSequence_webp();
 
     virtual int getWidth() const {
+        if (!mDemux) {
+            return 0;
+        }
         return WebPDemuxGetI(mDemux, WEBP_FF_CANVAS_WIDTH);
     }
 
     virtual int getHeight() const {
+        if (!mDemux) {
+            return 0;
+        }
         return WebPDemuxGetI(mDemux, WEBP_FF_CANVAS_HEIGHT);
     }
 
@@ -44,6 +50,9 @@ public:
     }
 
     virtual int getFrameCount() const {
+        if (!mDemux) {
+            return 0;
+        }
         return WebPDemuxGetI(mDemux, WEBP_FF_FRAME_COUNT);
     }
 
-- 
cgit v1.2.3