commit 0f4908973c8e71d145d2d2ce43d00b32e9581197
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Wed Apr 20 10:12:57 2016 +0530
committer Feng Yu <feny@google.com> Tue May 24 23:52:40 2016 +0000
tree 30f6ec9d73ec3e01cf3eaead51091573c335d771
parent 8bf56fc51ae6227cae390b3f9547985ca6bf6d64

Fixed out of bound read in flush_bits

Bug: 28168413
Change-Id: I3db5432a08daf665e160c0dab2d1928a576418b4
(cherry picked from commit 763ffef681432ec1dbe26d5010a67aaf8f7fc17e)

decoder/impeg2d_bitstream.c

diff --git a/decoder/impeg2d_bitstream.c b/decoder/impeg2d_bitstream.c
index b67161d..36092e5 100644
--- a/decoder/impeg2d_bitstream.c
+++ b/decoder/impeg2d_bitstream.c
@@ -191,12 +191,21 @@
 INLINE void impeg2d_bit_stream_flush(void* pv_ctxt, UWORD32 u4_no_of_bits)
 {
     stream_t *ps_stream = (stream_t *)pv_ctxt;
-
-
-    if (ps_stream->u4_offset < ps_stream->u4_max_offset)
+    if ((ps_stream->u4_offset + 64) < ps_stream->u4_max_offset)
     {
         FLUSH_BITS(ps_stream->u4_offset,ps_stream->u4_buf,ps_stream->u4_buf_nxt,u4_no_of_bits,ps_stream->pu4_buf_aligned)
     }
+    else
+    {
+        UWORD32     u4_temp;
+
+        if (((ps_stream->u4_offset & 0x1f) + u4_no_of_bits) >= 32)
+        {
+            ps_stream->u4_buf              = ps_stream->u4_buf_nxt;
+            ps_stream->u4_buf_nxt          = 0;
+        }
+        ps_stream->u4_offset += u4_no_of_bits;
+    }
     return;
 }
 /******************************************************************************