commit 874ec86ebc323baa7e6a6ab784dc4550444d6aa6
author Marco Nelissen <marcone@google.com> Thu Aug 01 16:16:08 2019 -0700
committer android-build-merger <android-build-merger@google.com> Thu Aug 01 16:16:08 2019 -0700
tree 5acaa25657e1c804fa8321b4ee74f1914ff142c6
parent b44663498f7e6513b4fe23db1362be80e7f28ad6
parent 6cf42dbae74a1237cf8861888f990280abbd6ef5

[automerger] Fix OOB access in mpeg4/h263 decoder am: ef4ce15700 am: 9832a2a3f4 am: 144ba69187 am: 6fa588c7b6 am: 88c0c4897c am: efd8f9e09a am: e545f3c8d3
am: 6cf42dbae7

Change-Id: Iae11a06a5f69d5528195a1856106c3ebc2cfee49

media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp

diff --git a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
index f18f789..679b091 100644
--- a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
+++ b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
@@ -1355,6 +1355,14 @@
             int tmpHeight = (tmpDisplayHeight + 15) & -16;
             int tmpWidth = (tmpDisplayWidth + 15) & -16;
 
+            if (tmpWidth > video->width)
+            {
+                // while allowed by the spec, this decoder does not actually
+                // support an increase in size.
+                ALOGE("width increase not supported");
+                status = PV_FAIL;
+                goto return_point;
+            }
             if (tmpHeight * tmpWidth > video->size)
             {
                 // This is just possibly "b/37079296".