commit e03b8da68f70d785c6566440d797a579c8c74ed0
author Jean-Michel Trivi <jmtrivi@google.com> Mon Oct 30 11:31:03 2017 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Fri Dec 01 00:14:14 2017 +0000
tree 9e6f4e82bb4367174d106957dd490aa48c8e9e98
parent 508c82f6e77bc736f2932d3059f91565df72fd69

Fix out of bound memory access in lppTransposer

In TRANSPOSER_SETTINGS, initialize the whole bwBorders array to a
  reasonable value to guarantee correct termination in while loop
  in lppTransposer function. This fixes the reported bug.
For completeness:
  - clear the whole bwIndex array instead of noOfPatches entries only.
  - abort criterion in while loop to prevent potential
    infinite loop, and limit bwIndex[patch] to a valid range.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65280786

Change-Id: I16ed2e1c0f1601926239a652ca20a91284151843
(cherry picked from commit 6d3dd40e204bf550abcfa589bd9615df8778e118)