commit 4e314d9197ce973089cdadb8515444f418d5712e
author Dongwon Kang <dwkang@google.com> Thu Jun 27 12:16:56 2019 -0700
committer android-build-merger <android-build-merger@google.com> Thu Jun 27 12:16:56 2019 -0700
tree d301d03b3684a30d209c1c505e94daeac5e912bd
parent 29b1c433c21a67d9efb2616a26baeaefc2026718
parent 3c1c45dd71bf40976879caab9fafec81035d5666

[automerger] m4v_h263: add a test for invalid/negative value am: 7802c68aeb am: 08aa2367b5 am: 644ad716f0 am: c9528234a1 am: ee98fbf584 am: e82c14f41d
am: 3c1c45dd71

Change-Id: Icf5f4e75782e692f090c25e8f682f94757e16d7e

media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp

diff --git a/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp b/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp
index 48414d7..5880e32 100644
--- a/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp
+++ b/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp
@@ -52,7 +52,11 @@
         PV_BitstreamByteAlign(stream);
         BitstreamReadBits32(stream, resync_marker_length);
 
-        *next_MB = (int) BitstreamReadBits16(stream, nbits);
+        int mbnum = (int) BitstreamReadBits16(stream, nbits);
+        if (mbnum < 0) {
+            return PV_FAIL;
+        }
+        *next_MB = mbnum;
 //      if (*next_MB <= video->mbnum)   /*  needs more investigation */
 //          *next_MB = video->mbnum+1;