| commit | 644ad716f0a5ff794aa1a403b0d2fc7164382e7e | [log] [tgz] |
|---|---|---|
| author | Android Build Merger (Role) <noreply-android-build-merger@google.com> | Fri Jun 21 21:22:31 2019 +0000 |
| committer | Android Build Merger (Role) <noreply-android-build-merger@google.com> | Fri Jun 21 21:22:31 2019 +0000 |
| tree | 9bd4ffbe399d8fd55eda192e6dbf4304acc245cf | |
| parent | 30d710f5af65952c3d891a374b61f90fadd2ba45 [diff] | |
| parent | 08aa2367b5f627068249b8a1003365ac2d16b1cc [diff] |
[automerger] m4v_h263: add a test for invalid/negative value am: 7802c68aeb am: 08aa2367b5 Change-Id: Ie1301b5ec3749d8bb09f5a48137402364c81d102
diff --git a/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp b/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp index 48414d7..5880e32 100644 --- a/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp +++ b/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp
@@ -52,7 +52,11 @@ PV_BitstreamByteAlign(stream); BitstreamReadBits32(stream, resync_marker_length); - *next_MB = (int) BitstreamReadBits16(stream, nbits); + int mbnum = (int) BitstreamReadBits16(stream, nbits); + if (mbnum < 0) { + return PV_FAIL; + } + *next_MB = mbnum; // if (*next_MB <= video->mbnum) /* needs more investigation */ // *next_MB = video->mbnum+1;