diff options
| -rw-r--r-- | media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp | 6 | ||||
| -rw-r--r-- | media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp | 8 |
2 files changed, 13 insertions, 1 deletions
diff --git a/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp b/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp index 48414d7b32..5880e3260d 100644 --- a/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp +++ b/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp @@ -52,7 +52,11 @@ PV_STATUS PV_ReadVideoPacketHeader(VideoDecData *video, int *next_MB) PV_BitstreamByteAlign(stream); BitstreamReadBits32(stream, resync_marker_length); - *next_MB = (int) BitstreamReadBits16(stream, nbits); + int mbnum = (int) BitstreamReadBits16(stream, nbits); + if (mbnum < 0) { + return PV_FAIL; + } + *next_MB = mbnum; // if (*next_MB <= video->mbnum) /* needs more investigation */ // *next_MB = video->mbnum+1; diff --git a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp index f18f789b99..679b0911df 100644 --- a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp +++ b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp @@ -1355,6 +1355,14 @@ PV_STATUS DecodeShortHeader(VideoDecData *video, Vop *currVop) int tmpHeight = (tmpDisplayHeight + 15) & -16; int tmpWidth = (tmpDisplayWidth + 15) & -16; + if (tmpWidth > video->width) + { + // while allowed by the spec, this decoder does not actually + // support an increase in size. + ALOGE("width increase not supported"); + status = PV_FAIL; + goto return_point; + } if (tmpHeight * tmpWidth > video->size) { // This is just possibly "b/37079296". |