commit b875a5fe0db2e2d4bf44746bb8ca4dc1e959925e
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Fri Apr 10 04:31:59 2020 +0530
committer Anis Assi <anisassi@google.com> Thu Jun 04 11:26:21 2020 -0700
tree 86a024f86891b9f79127920b1d257b726a589702
parent 1b95a26ca579f0dae2678f1642308edb310daebd

m4v_h263: Return error for zero width and height

Test: poc in bug
Bug: 152496149
Bug: 152629190

Change-Id: I07293e97b664e03e29a1392b139132fc137361cd
(cherry picked from commit 5d8def9a0235d97fd6dfd88fb8b6b25bf98411c5)

media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp

diff --git a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
index 679b091..a11f55e 100644
--- a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
+++ b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
@@ -409,7 +409,9 @@
         if (!BitstreamRead1Bits(stream)) return PV_FAIL;
 
         /* video_object_layer_width (13 bits) */
-        video->displayWidth = video->width = (int) BitstreamReadBits16(stream, 13);
+        tmpvar = BitstreamReadBits16(stream, 13);
+        if (!tmpvar) return PV_FAIL;
+        video->displayWidth = video->width = tmpvar;
 
         /* round up to a multiple of MB_SIZE.   08/09/2000 */
         video->width = (video->width + 15) & -16;
@@ -419,7 +421,9 @@
         if (!BitstreamRead1Bits(stream)) return PV_FAIL;
 
         /* video_object_layer_height (13 bits) */
-        video->displayHeight = video->height = (int) BitstreamReadBits16(stream, 13);
+        tmpvar = BitstreamReadBits16(stream, 13);
+        if (!tmpvar) return PV_FAIL;
+        video->displayHeight = video->height = tmpvar;
 
         /* round up to a multiple of MB_SIZE.   08/09/2000 */
         video->height = (video->height + 15) & -16;