frameworks/av
| Revision | 134bf4791cc6919926365fb1500b680e0e1a4f84 (tree) |
|---|---|
| Time | 2020-05-20 23:08:41 |
| Author | Chih-Wei Huang <cwhuang@linu...> |
| Commiter | Chih-Wei Huang |
Merge remote-tracking branch 'cm/cm-14.1' into cm-14.1-x86
media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp (diff) media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp (diff)| @@ -52,7 +52,11 @@ PV_STATUS PV_ReadVideoPacketHeader(VideoDecData *video, int *next_MB) | ||
| 52 | 52 | PV_BitstreamByteAlign(stream); |
| 53 | 53 | BitstreamReadBits32(stream, resync_marker_length); |
| 54 | 54 | |
| 55 | - *next_MB = (int) BitstreamReadBits16(stream, nbits); | |
| 55 | + int mbnum = (int) BitstreamReadBits16(stream, nbits); | |
| 56 | + if (mbnum < 0) { | |
| 57 | + return PV_FAIL; | |
| 58 | + } | |
| 59 | + *next_MB = mbnum; | |
| 56 | 60 | // if (*next_MB <= video->mbnum) /* needs more investigation */ |
| 57 | 61 | // *next_MB = video->mbnum+1; |
| 58 | 62 |
| @@ -1355,6 +1355,14 @@ PV_STATUS DecodeShortHeader(VideoDecData *video, Vop *currVop) | ||
| 1355 | 1355 | int tmpHeight = (tmpDisplayHeight + 15) & -16; |
| 1356 | 1356 | int tmpWidth = (tmpDisplayWidth + 15) & -16; |
| 1357 | 1357 | |
| 1358 | + if (tmpWidth > video->width) | |
| 1359 | + { | |
| 1360 | + // while allowed by the spec, this decoder does not actually | |
| 1361 | + // support an increase in size. | |
| 1362 | + ALOGE("width increase not supported"); | |
| 1363 | + status = PV_FAIL; | |
| 1364 | + goto return_point; | |
| 1365 | + } | |
| 1358 | 1366 | if (tmpHeight * tmpWidth > video->size) |
| 1359 | 1367 | { |
| 1360 | 1368 | // This is just possibly "b/37079296". |
Fork