commit 9245d5f248c5fc2450ca37743c76e8635a49730b
author Wei Jia <wjia@google.com> Wed Aug 19 17:31:51 2015 -0700
committer The Android Automerger <android-build@google.com> Tue Sep 08 13:36:47 2015 -0700
tree 3abf36f2051a6d28f53fc1d2351753ce4cc31a47
parent 2e1c69496b063852da86d85dfb6cb56fff615b7b

libstagefright: fix overflow in pvdec_api.cpp.

Bug: 20674086
Change-Id: Ie2c711865c3b92f3fa2f3c7a436fa0e3687eb8b3
(cherry picked from commit d7bb1cd786e5ea4ac61119cc1a08082474f7787b)

media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp

diff --git a/media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp b/media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp
index 79e4e4f..c1720c6 100644
--- a/media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp
+++ b/media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp
@@ -343,7 +343,7 @@
     video->prevVop->uChan = video->prevVop->yChan + size;
     video->prevVop->vChan = video->prevVop->uChan + (size >> 2);
 #else
-    if (size > INT32_MAX / 3 * 2) {
+    if (size > INT32_MAX / 3) {
         return PV_FALSE;
     }
     video->currVop->yChan = (PIXEL *) oscl_malloc(size * 3 / 2); /* Allocate memory for all VOP OKA 3/2/1*/
@@ -373,7 +373,7 @@
         {
             oscl_memset(video->prevEnhcVop, 0, sizeof(Vop));
 #ifndef PV_MEMORY_POOL
-            if (size > INT32_MAX / 3 * 2) {
+            if (size > INT32_MAX / 3) {
                 return PV_FALSE;
             }