From 4a7fe9cd333c4cf533f78a074c8c2c820b94c6d2 Mon Sep 17 00:00:00 2001 From: Marco Nelissen Date: Wed, 27 Mar 2013 16:44:54 -0700 Subject: Fix valgrind error in software h264 decoder h264bsdNextMbAddress could read past the end of an allocation, which could conceivably result in a segfault if the allocation was at the very end of a page. Change-Id: Id7a0c5733d66e609f36feb0e15b2d67b9bbc0b4d --- media/libstagefright/codecs/on2/h264dec/source/h264bsd_util.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/media/libstagefright/codecs/on2/h264dec/source/h264bsd_util.c b/media/libstagefright/codecs/on2/h264dec/source/h264bsd_util.c index 53b2fd8..cc838fd 100755 --- a/media/libstagefright/codecs/on2/h264dec/source/h264bsd_util.c +++ b/media/libstagefright/codecs/on2/h264dec/source/h264bsd_util.c @@ -220,7 +220,7 @@ u32 h264bsdNextMbAddress(u32 *pSliceGroupMap, u32 picSizeInMbs, u32 currMbAddr) /* Variables */ - u32 i, sliceGroup, tmp; + u32 i, sliceGroup; /* Code */ @@ -231,11 +231,9 @@ u32 h264bsdNextMbAddress(u32 *pSliceGroupMap, u32 picSizeInMbs, u32 currMbAddr) sliceGroup = pSliceGroupMap[currMbAddr]; i = currMbAddr + 1; - tmp = pSliceGroupMap[i]; - while ((i < picSizeInMbs) && (tmp != sliceGroup)) + while ((i < picSizeInMbs) && (pSliceGroupMap[i] != sliceGroup)) { i++; - tmp = pSliceGroupMap[i]; } if (i == picSizeInMbs) -- cgit v1.1