commit 08aa2367b5f627068249b8a1003365ac2d16b1cc
author Android Build Merger (Role) <noreply-android-build-merger@google.com> Fri Jun 21 21:22:28 2019 +0000
committer Android Build Merger (Role) <noreply-android-build-merger@google.com> Fri Jun 21 21:22:28 2019 +0000
tree 5136bf03c4f2241b2c34fdd584581e8a38efd69c
parent 8b8f583fa51a0ba34b58efc50237d4513235692f
parent 7802c68aebf7908983508fd4a52a7d53746a80eb

[automerger] m4v_h263: add a test for invalid/negative value am: 7802c68aeb

Change-Id: Ia21e84bf3562c3892698f3a1513acccd5f530986

media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp

diff --git a/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp b/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp
index 48414d7..5880e32 100644
--- a/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp
+++ b/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp
@@ -52,7 +52,11 @@
         PV_BitstreamByteAlign(stream);
         BitstreamReadBits32(stream, resync_marker_length);
 
-        *next_MB = (int) BitstreamReadBits16(stream, nbits);
+        int mbnum = (int) BitstreamReadBits16(stream, nbits);
+        if (mbnum < 0) {
+            return PV_FAIL;
+        }
+        *next_MB = mbnum;
 //      if (*next_MB <= video->mbnum)   /*  needs more investigation */
 //          *next_MB = video->mbnum+1;