commit 79e21c88fe8f6c454e4b558fa33d12e4269a1565
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Fri Dec 23 15:29:14 2016 +0530
committer gitbuildkicker <android-build@google.com> Wed Feb 22 15:09:12 2017 -0800
tree 7c44b8166c43da7b9d346224a1f0c458351a234d
parent 2941056cf0ad85cf167e16c1c362279294814530

Decoder: Fixes an out of bound write in bitstream buffer

[for mnc-dr-dev and later;  mnc-dev gets a different patch]

After emulation prevention, data is written as an int,
so at least 3 additional bytes should be available.
And since bitstream functions read 8 bytes ahead, 8 extra bytes
should be available in the bitstream buffer.

Bug: 33934721

Change-Id: I444ec6f85d01b0bade9f827e15c4b476779d6c69
(cherry picked from commit 33ef7de9ddc8ea7eb9cbc440d1cf89957a0c267b)

decoder/ih264d_api.c

diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index 9d0f348..d96be5e 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -1989,7 +1989,9 @@
         if(buflen == -1)
             buflen = 0;
         /* Ignore bytes beyond the allocated size of intermediate buffer */
-        buflen = MIN(buflen, buf_size);
+        /* Since 8 bytes are read ahead, ensure 8 bytes are free at the
+        end of the buffer, which will be memset to 0 after emulation prevention */
+        buflen = MIN(buflen, buf_size - 8);
 
         bytes_consumed = buflen + u4_length_of_start_code;
         ps_dec_op->u4_num_bytes_consumed += bytes_consumed;