Android-x86
Fork
Donation

  • R/O
  • HTTP
  • SSH
  • HTTPS

frameworks-av: Commit

frameworks/av


Commit MetaInfo

Revision134bf4791cc6919926365fb1500b680e0e1a4f84 (tree)
Time2020-05-20 23:08:41
AuthorChih-Wei Huang <cwhuang@linu...>
CommiterChih-Wei Huang

Log Message

Merge remote-tracking branch 'cm/cm-14.1' into cm-14.1-x86

Change Summary

Incremental Difference

--- a/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp
+++ b/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp
@@ -52,7 +52,11 @@ PV_STATUS PV_ReadVideoPacketHeader(VideoDecData *video, int *next_MB)
5252 PV_BitstreamByteAlign(stream);
5353 BitstreamReadBits32(stream, resync_marker_length);
5454
55- *next_MB = (int) BitstreamReadBits16(stream, nbits);
55+ int mbnum = (int) BitstreamReadBits16(stream, nbits);
56+ if (mbnum < 0) {
57+ return PV_FAIL;
58+ }
59+ *next_MB = mbnum;
5660 // if (*next_MB <= video->mbnum) /* needs more investigation */
5761 // *next_MB = video->mbnum+1;
5862
--- a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
+++ b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
@@ -1355,6 +1355,14 @@ PV_STATUS DecodeShortHeader(VideoDecData *video, Vop *currVop)
13551355 int tmpHeight = (tmpDisplayHeight + 15) & -16;
13561356 int tmpWidth = (tmpDisplayWidth + 15) & -16;
13571357
1358+ if (tmpWidth > video->width)
1359+ {
1360+ // while allowed by the spec, this decoder does not actually
1361+ // support an increase in size.
1362+ ALOGE("width increase not supported");
1363+ status = PV_FAIL;
1364+ goto return_point;
1365+ }
13581366 if (tmpHeight * tmpWidth > video->size)
13591367 {
13601368 // This is just possibly "b/37079296".
Show on old repository browser