From 5d8def9a0235d97fd6dfd88fb8b6b25bf98411c5 Mon Sep 17 00:00:00 2001 From: Harish Mahendrakar Date: Fri, 10 Apr 2020 04:31:59 +0530 Subject: [PATCH] m4v_h263: Return error for zero width and height Test: poc in bug Bug: 152496149 Bug: 152629190 Change-Id: I07293e97b664e03e29a1392b139132fc137361cd --- media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp index 679b0911df..a11f55e34a 100644 --- a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp +++ b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp @@ -409,7 +409,9 @@ decode_vol: if (!BitstreamRead1Bits(stream)) return PV_FAIL; /* video_object_layer_width (13 bits) */ - video->displayWidth = video->width = (int) BitstreamReadBits16(stream, 13); + tmpvar = BitstreamReadBits16(stream, 13); + if (!tmpvar) return PV_FAIL; + video->displayWidth = video->width = tmpvar; /* round up to a multiple of MB_SIZE. 08/09/2000 */ video->width = (video->width + 15) & -16; @@ -419,7 +421,9 @@ decode_vol: if (!BitstreamRead1Bits(stream)) return PV_FAIL; /* video_object_layer_height (13 bits) */ - video->displayHeight = video->height = (int) BitstreamReadBits16(stream, 13); + tmpvar = BitstreamReadBits16(stream, 13); + if (!tmpvar) return PV_FAIL; + video->displayHeight = video->height = tmpvar; /* round up to a multiple of MB_SIZE. 08/09/2000 */ video->height = (video->height + 15) & -16;