diff options
author | Jessica Wagantall <jwagantall@cyngn.com> | 2016-07-07 12:07:33 -0700 |
---|---|---|
committer | Jessica Wagantall <jwagantall@cyngn.com> | 2016-07-07 14:15:22 -0700 |
commit | 1e7c9d2c408b17fa14f897cfe8d1ae06fe944637 (patch) | |
tree | 2e132ad77cb30013947b94eeb8d4835bbd01f664 /media/libstagefright/codecs | |
parent | fbef511c958b5f1b3e015d032dcac4ed7cc84876 (diff) | |
parent | d112f7d0c1dbaf0368365885becb11ca8d3f13a4 (diff) | |
download | frameworks_av-1e7c9d2c408b17fa14f897cfe8d1ae06fe944637.zip frameworks_av-1e7c9d2c408b17fa14f897cfe8d1ae06fe944637.tar.gz frameworks_av-1e7c9d2c408b17fa14f897cfe8d1ae06fe944637.tar.bz2 |
Merge remote-tracking branch 'remotes/android-6.0.1_r52' into HEAD
Ticket: CYNGNOS-3020
Change-Id: I7e8d69c5f7041b66893ea643c4bc19c3b7bcdda5
Diffstat (limited to 'media/libstagefright/codecs')
-rw-r--r-- | media/libstagefright/codecs/on2/h264dec/source/h264bsd_storage.c | 24 |
1 files changed, 21 insertions, 3 deletions
diff --git a/media/libstagefright/codecs/on2/h264dec/source/h264bsd_storage.c b/media/libstagefright/codecs/on2/h264dec/source/h264bsd_storage.c index 3234754..ff7a42a 100644 --- a/media/libstagefright/codecs/on2/h264dec/source/h264bsd_storage.c +++ b/media/libstagefright/codecs/on2/h264dec/source/h264bsd_storage.c @@ -58,6 +58,10 @@ 3. Module defines ------------------------------------------------------------------------------*/ +#ifndef UINT32_MAX +#define UINT32_MAX (4294967295U) +#endif + /*------------------------------------------------------------------------------ 4. Local function prototypes ------------------------------------------------------------------------------*/ @@ -326,9 +330,23 @@ u32 h264bsdActivateParamSets(storage_t *pStorage, u32 ppsId, u32 isIdr) pStorage->activePps = pStorage->pps[ppsId]; pStorage->activeSpsId = pStorage->activePps->seqParameterSetId; pStorage->activeSps = pStorage->sps[pStorage->activeSpsId]; - pStorage->picSizeInMbs = - pStorage->activeSps->picWidthInMbs * - pStorage->activeSps->picHeightInMbs; + + /* report error before multiplication to prevent integer overflow */ + if (pStorage->activeSps->picWidthInMbs == 0) + { + pStorage->picSizeInMbs = 0; + } + else if (pStorage->activeSps->picHeightInMbs > + UINT32_MAX / pStorage->activeSps->picWidthInMbs) + { + return(MEMORY_ALLOCATION_ERROR); + } + else + { + pStorage->picSizeInMbs = + pStorage->activeSps->picWidthInMbs * + pStorage->activeSps->picHeightInMbs; + } pStorage->currImage->width = pStorage->activeSps->picWidthInMbs; pStorage->currImage->height = pStorage->activeSps->picHeightInMbs; |