commit 7a661210e1299bc68aa141366e2c1d0d31cf32c1
author ywan171 <yi.a.wang@intel.com> Fri Jan 10 10:16:29 2014 +0800
committer Patrick Tjin <pattjin@google.com> Mon Jul 21 21:51:48 2014 -0700
tree 2ba107e363b17812799e7a379ae8de612d3ddeeb
parent 709f4581dd885594a3e1e08d3d3487375ef85fc5

mixvbp: let the VOL be parsed if the previous header/frame is corrupted

BZ: 163232

let later VOL be parsed if the previous header/frame is corrupted
check width/height to avoid corrupted VOL make decoder crash.

Change-Id: I6fdf2cc69a1b856e8cae48420d530f4fdf0fcbe3
Signed-off-by: ywan171 <yi.a.wang@intel.com>

mixvbp/vbp_plugin/mp4/viddec_mp4_videoobjectlayer.c

diff --git a/mixvbp/vbp_plugin/mp4/viddec_mp4_videoobjectlayer.c b/mixvbp/vbp_plugin/mp4/viddec_mp4_videoobjectlayer.c
index 30f9ea3..a538240 100755
--- a/mixvbp/vbp_plugin/mp4/viddec_mp4_videoobjectlayer.c
+++ b/mixvbp/vbp_plugin/mp4/viddec_mp4_videoobjectlayer.c
@@ -304,8 +304,15 @@
             /* TODO: check for validity of marker bits */
             getbits = viddec_pm_get_bits(parent, &(code), 29);
             BREAK_GETBITS_REQD_MISSING(getbits, ret);
-            vidObjLay->video_object_layer_height = (code >> 1) & 0x1FFF;
-            vidObjLay->video_object_layer_width = (code >> 15) & 0x1FFF;
+            int height = (code >> 1) & 0x1FFF;
+            int width = (code >> 15) & 0x1FFF;
+            if (width > 4096 || height > 4096) {
+               ret = (mp4_Status_t)(MP4_STATUS_NOTSUPPORT | MP4_STATUS_REQD_DATA_ERROR);
+               ETRACE("width or height is invalid: width = %d, height = %d", width, height);
+               break;
+            }
+            vidObjLay->video_object_layer_height = height;
+            vidObjLay->video_object_layer_width = width;
         }
 
         getbits = viddec_pm_get_bits(parent, &(code), 2);
@@ -447,10 +454,6 @@
 
 //VTRACE("entering mp4_Parse_VideoObjectLayer: bs_err: %d, ret: %d\n", parser->bitstream_error, ret);
 
-    // Trying to parse more header data as it is more important than frame data
-    if (parser->bitstream_error > MP4_HDR_ERROR_MASK)
-        return ret;
-
     do {
         vidObjLay->VideoObjectPlane.sprite_transmit_mode = MP4_SPRITE_TRANSMIT_MODE_PIECE;