diff options
| author | Marco Nelissen <marcone@google.com> | 2019-08-01 16:16:08 -0700 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2019-08-01 16:16:08 -0700 |
| commit | 874ec86ebc323baa7e6a6ab784dc4550444d6aa6 (patch) | |
| tree | 5acaa25657e1c804fa8321b4ee74f1914ff142c6 | |
| parent | b44663498f7e6513b4fe23db1362be80e7f28ad6 (diff) | |
| parent | 6cf42dbae74a1237cf8861888f990280abbd6ef5 (diff) | |
| download | frameworks_av-874ec86ebc323baa7e6a6ab784dc4550444d6aa6.tar.gz frameworks_av-874ec86ebc323baa7e6a6ab784dc4550444d6aa6.tar.bz2 frameworks_av-874ec86ebc323baa7e6a6ab784dc4550444d6aa6.zip | |
[automerger] Fix OOB access in mpeg4/h263 decoder am: ef4ce15700 am: 9832a2a3f4 am: 144ba69187 am: 6fa588c7b6 am: 88c0c4897c am: efd8f9e09a am: e545f3c8d3
am: 6cf42dbae7
Change-Id: Iae11a06a5f69d5528195a1856106c3ebc2cfee49
| -rw-r--r-- | media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp index f18f789b99..679b0911df 100644 --- a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp +++ b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp @@ -1355,6 +1355,14 @@ PV_STATUS DecodeShortHeader(VideoDecData *video, Vop *currVop) int tmpHeight = (tmpDisplayHeight + 15) & -16; int tmpWidth = (tmpDisplayWidth + 15) & -16; + if (tmpWidth > video->width) + { + // while allowed by the spec, this decoder does not actually + // support an increase in size. + ALOGE("width increase not supported"); + status = PV_FAIL; + goto return_point; + } if (tmpHeight * tmpWidth > video->size) { // This is just possibly "b/37079296". |