diff options
| author | Wei Jia <wjia@google.com> | 2015-08-19 17:31:51 -0700 |
|---|---|---|
| committer | Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de> | 2015-10-19 01:50:02 +0200 |
| commit | c8037f6245d07b6adfbcea23839e773ea048d38b (patch) | |
| tree | c2328c3834e639677c90eda52f575ac9e1603d1a | |
| parent | 595644d0f542cad71520005da0dadb1ef371ba9e (diff) | |
| download | frameworks_av-c8037f6245d07b6adfbcea23839e773ea048d38b.zip frameworks_av-c8037f6245d07b6adfbcea23839e773ea048d38b.tar.gz frameworks_av-c8037f6245d07b6adfbcea23839e773ea048d38b.tar.bz2 | |
libstagefright: fix overflow in pvdec_api.cpp.
Bug: 20674086
Change-Id: Ie2c711865c3b92f3fa2f3c7a436fa0e3687eb8b3
(cherry picked from commit d7bb1cd786e5ea4ac61119cc1a08082474f7787b)
Tested-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
| -rw-r--r-- | media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp b/media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp index b1a39e6..ead77ef 100644 --- a/media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp +++ b/media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp @@ -341,7 +341,7 @@ Bool PVAllocVideoData(VideoDecControls *decCtrl, int width, int height, int nLay video->prevVop->uChan = video->prevVop->yChan + size; video->prevVop->vChan = video->prevVop->uChan + (size >> 2); #else - if (size > INT32_MAX / 3 * 2) { + if (size > INT32_MAX / 3) { return PV_FALSE; } video->currVop->yChan = (PIXEL *) oscl_malloc(size * 3 / 2); /* Allocate memory for all VOP OKA 3/2/1*/ @@ -371,7 +371,7 @@ Bool PVAllocVideoData(VideoDecControls *decCtrl, int width, int height, int nLay { oscl_memset(video->prevEnhcVop, 0, sizeof(Vop)); #ifndef PV_MEMORY_POOL - if (size > INT32_MAX / 3 * 2) { + if (size > INT32_MAX / 3) { return PV_FALSE; } |