h264dec: check for overflows when calculating allocation size.

Bug: 27855419
Change-Id: Idabedca52913ec31ea5cb6a6109ab94e3fb2badd

1 files changed, 6 insertions, 3 deletions

diff --git a/media/libstagefright/codecs/on2/h264dec/source/DecTestBench.c b/media/libstagefright/codecs/on2/h264dec/source/DecTestBench.c
index dcf2ef6..55c0065 100644
--- a/media/libstagefright/codecs/on2/h264dec/source/DecTestBench.c
+++ b/media/libstagefright/codecs/on2/h264dec/source/DecTestBench.c
@@ -700,18 +700,21 @@ void H264SwDecTrace(char *string)
         library function malloc for allocation of memory.
 
 ------------------------------------------------------------------------------*/
-void* H264SwDecMalloc(u32 size)
+void* H264SwDecMalloc(u32 size, u32 num)
 {
+    if (size > UINT32_MAX / num) {
+        return NULL;
+    }
 
 #if defined(CHECK_MEMORY_USAGE)
     /* Note that if the decoder has to free and reallocate some of the buffers
      * the total value will be invalid */
     static u32 numBytes = 0;
-    numBytes += size;
+    numBytes += size * num;
     DEBUG(("Allocated %d bytes, total %d\n", size, numBytes));
 #endif
 
-    return malloc(size);
+    return malloc(size * num);
 }
 
 /*------------------------------------------------------------------------------