release-request-655284b0-7f0b-48b5-b01d-27f48a99f2c0-for-git_oc-mr1-release-4017105 snap-temp-L82600000064873863android-wear-8.1.0_r1android-vts-8.1_r9android-vts-8.1_r8android-vts-8.1_r7android-vts-8.1_r6android-vts-8.1_r5android-vts-8.1_r4android-vts-8.1_r3android-vts-8.1_r14android-vts-8.1_r13android-vts-8.1_r12android-vts-8.1_r11android-vts-8.1_r10android-security-8.1.0_r93android-security-8.1.0_r92android-security-8.1.0_r91android-security-8.1.0_r90android-security-8.1.0_r89android-security-8.1.0_r88android-security-8.1.0_r87android-security-8.1.0_r86android-security-8.1.0_r85android-security-8.1.0_r84android-security-8.1.0_r83android-security-8.1.0_r82android-cts-8.1_r9android-cts-8.1_r8android-cts-8.1_r7android-cts-8.1_r6android-cts-8.1_r5android-cts-8.1_r4android-cts-8.1_r3android-cts-8.1_r25android-cts-8.1_r24android-cts-8.1_r23android-cts-8.1_r22android-cts-8.1_r21android-cts-8.1_r20android-cts-8.1_r2android-cts-8.1_r19android-cts-8.1_r18android-cts-8.1_r17android-cts-8.1_r16android-cts-8.1_r15android-cts-8.1_r14android-cts-8.1_r13android-cts-8.1_r12android-cts-8.1_r11android-cts-8.1_r10android-cts-8.1_r1android-8.1.0_r9android-8.1.0_r81android-8.1.0_r80android-8.1.0_r8android-8.1.0_r79android-8.1.0_r78android-8.1.0_r77android-8.1.0_r76android-8.1.0_r75android-8.1.0_r74android-8.1.0_r73android-8.1.0_r72android-8.1.0_r71android-8.1.0_r70android-8.1.0_r7android-8.1.0_r69android-8.1.0_r68android-8.1.0_r67android-8.1.0_r66android-8.1.0_r65android-8.1.0_r64android-8.1.0_r63android-8.1.0_r62android-8.1.0_r61android-8.1.0_r60android-8.1.0_r6android-8.1.0_r53android-8.1.0_r52android-8.1.0_r51android-8.1.0_r50android-8.1.0_r5android-8.1.0_r48android-8.1.0_r47android-8.1.0_r46android-8.1.0_r45android-8.1.0_r43android-8.1.0_r42android-8.1.0_r41android-8.1.0_r40android-8.1.0_r4android-8.1.0_r39android-8.1.0_r38android-8.1.0_r37android-8.1.0_r36android-8.1.0_r35android-8.1.0_r33android-8.1.0_r32android-8.1.0_r31android-8.1.0_r30android-8.1.0_r3android-8.1.0_r29android-8.1.0_r28android-8.1.0_r27android-8.1.0_r26android-8.1.0_r25android-8.1.0_r23android-8.1.0_r22android-8.1.0_r21android-8.1.0_r20android-8.1.0_r2android-8.1.0_r19android-8.1.0_r18android-8.1.0_r17android-8.1.0_r16android-8.1.0_r15android-8.1.0_r14android-8.1.0_r13android-8.1.0_r12android-8.1.0_r11android-8.1.0_r10android-8.1.0_r1security-oc-mr1-releaseoreo-mr1-wear-releaseoreo-mr1-vts-releaseoreo-mr1-security-releaseoreo-mr1-s1-releaseoreo-mr1-releaseoreo-mr1-cuttlefish-testingoreo-mr1-cts-releaseoreo-m8-releaseoreo-m7-releaseoreo-m6-s4-releaseoreo-m6-s3-releaseoreo-m6-s2-releaseoreo-m5-releaseoreo-m4-s9-releaseoreo-m4-s8-releaseoreo-m4-s7-releaseoreo-m4-s6-releaseoreo-m4-s5-releaseoreo-m4-s4-releaseoreo-m4-s3-releaseoreo-m4-s2-releaseoreo-m4-s12-releaseoreo-m4-s11-releaseoreo-m4-s10-releaseoreo-m4-s1-releaseoreo-m3-releaseoreo-m2-s5-releaseoreo-m2-s4-releaseoreo-m2-s3-releaseoreo-m2-s2-releaseoreo-m2-s1-releaseoreo-m2-release

Change-Id: I7ca756448130c545cd6aa116d3a368b31fd2be06

5 files changed, 65 insertions, 0 deletions

diff --git a/videodecoder/VideoDecoderAVC.cpp b/videodecoder/VideoDecoderAVC.cpp
index f0e047e..a9ddc8b 100644
--- a/videodecoder/VideoDecoderAVC.cpp
+++ b/videodecoder/VideoDecoderAVC.cpp
@@ -25,6 +25,9 @@
 #define NW_CONSUMED     2
 #define POC_DEFAULT     0x7FFFFFFF
 
+#define MAX_PICTURE_WIDTH_AVC 4096
+#define MAX_PICTURE_HEIGHT_AVC 4096
+
 VideoDecoderAVC::VideoDecoderAVC(const char *mimeType)
     : VideoDecoderBase(mimeType, VBP_H264),
       mToggleDPB(0),
@@ -65,6 +68,11 @@ Decode_Status VideoDecoderAVC::start(VideoConfigBuffer *buffer) {
     status = VideoDecoderBase::parseBuffer(buffer->data, buffer->size, true, (void**)&data);
     CHECK_STATUS("VideoDecoderBase::parseBuffer");
 
+    if (data->codec_data->frame_width > MAX_PICTURE_WIDTH_AVC ||
+            data->codec_data->frame_height > MAX_PICTURE_HEIGHT_AVC) {
+        return DECODE_INVALID_DATA;
+    }
+
     status = startVA(data);
     return status;
 }
@@ -102,6 +110,11 @@ Decode_Status VideoDecoderAVC::decode(VideoDecodeBuffer *buffer) {
             (void**)&data);
     CHECK_STATUS("VideoDecoderBase::parseBuffer");
 
+    if (data->codec_data->frame_width > MAX_PICTURE_WIDTH_AVC ||
+            data->codec_data->frame_height > MAX_PICTURE_HEIGHT_AVC) {
+        return DECODE_INVALID_DATA;
+    }
+
     if (!mVAStarted) {
          if (data->has_sps && data->has_pps) {
             status = startVA(data);
diff --git a/videodecoder/VideoDecoderMPEG2.cpp b/videodecoder/VideoDecoderMPEG2.cpp
index 928ee9b..9d6a784 100644
--- a/videodecoder/VideoDecoderMPEG2.cpp
+++ b/videodecoder/VideoDecoderMPEG2.cpp
@@ -18,6 +18,9 @@
 #include "VideoDecoderTrace.h"
 #include <string.h>
 
+#define MAX_PICTURE_WIDTH_MPEG2 1920
+#define MAX_PICTURE_HEIGHT_MPEG2 1088
+
 VideoDecoderMPEG2::VideoDecoderMPEG2(const char *mimeType)
     : VideoDecoderBase(mimeType, VBP_MPEG2),
     mBufferIDs(NULL),
@@ -48,6 +51,11 @@ Decode_Status VideoDecoderMPEG2::start(VideoConfigBuffer *buffer) {
             (void**)&data);
     CHECK_STATUS("VideoDecoderBase::parseBuffer");
 
+    if (data->codec_data->frame_width > MAX_PICTURE_WIDTH_MPEG2 ||
+            data->codec_data->frame_height > MAX_PICTURE_HEIGHT_MPEG2) {
+        return DECODE_INVALID_DATA;
+    }
+
     status = startVA(data);
     return status;
 }
@@ -85,6 +93,11 @@ Decode_Status VideoDecoderMPEG2::decode(VideoDecodeBuffer *buffer) {
             (void**)&data);
     CHECK_STATUS("VideoDecoderBase::parseBuffer");
 
+    if (data->codec_data->frame_width > MAX_PICTURE_WIDTH_MPEG2 ||
+            data->codec_data->frame_height > MAX_PICTURE_HEIGHT_MPEG2) {
+        return DECODE_INVALID_DATA;
+    }
+
     if (!mVAStarted) {
         status = startVA(data);
         CHECK_STATUS("startVA");
diff --git a/videodecoder/VideoDecoderMPEG4.cpp b/videodecoder/VideoDecoderMPEG4.cpp
index 6472446..51543ab 100644
--- a/videodecoder/VideoDecoderMPEG4.cpp
+++ b/videodecoder/VideoDecoderMPEG4.cpp
@@ -18,6 +18,9 @@
 #include "VideoDecoderTrace.h"
 #include <string.h>
 
+#define MAX_PICTURE_WIDTH_MPEG4   1920
+#define MAX_PICTURE_HEIGHT_MPEG4  1088
+
 VideoDecoderMPEG4::VideoDecoderMPEG4(const char *mimeType)
     : VideoDecoderBase(mimeType, VBP_MPEG4),
       mLastVOPTimeIncrement(0),
@@ -46,6 +49,11 @@ Decode_Status VideoDecoderMPEG4::start(VideoConfigBuffer *buffer) {
     status = VideoDecoderBase::parseBuffer(buffer->data, buffer->size, true, (void**)&data);
     CHECK_STATUS("VideoDecoderBase::parseBuffer");
 
+    if (data->codec_data.video_object_layer_width > MAX_PICTURE_WIDTH_MPEG4 ||
+            data->codec_data.video_object_layer_height > MAX_PICTURE_HEIGHT_MPEG4) {
+        return DECODE_INVALID_DATA;
+    }
+
     status = startVA(data);
     return status;
 }
@@ -80,6 +88,11 @@ Decode_Status VideoDecoderMPEG4::decode(VideoDecodeBuffer *buffer) {
             (void**)&data);
     CHECK_STATUS("VideoDecoderBase::parseBuffer");
 
+    if (data->codec_data.video_object_layer_width > MAX_PICTURE_WIDTH_MPEG4 ||
+            data->codec_data.video_object_layer_height > MAX_PICTURE_HEIGHT_MPEG4) {
+        return DECODE_INVALID_DATA;
+    }
+
     if (!mVAStarted) {
         status = startVA(data);
         CHECK_STATUS("startVA");
diff --git a/videodecoder/VideoDecoderVP8.cpp b/videodecoder/VideoDecoderVP8.cpp
index ab561da..a3d700a 100644
--- a/videodecoder/VideoDecoderVP8.cpp
+++ b/videodecoder/VideoDecoderVP8.cpp
@@ -18,6 +18,9 @@
 #include "VideoDecoderTrace.h"
 #include <string.h>
 
+#define MAX_PICTURE_WIDTH_VP8   1920
+#define MAX_PICTURE_HEIGHT_VP8  1088
+
 VideoDecoderVP8::VideoDecoderVP8(const char *mimeType)
     : VideoDecoderBase(mimeType, VBP_VP8) {
     invalidateReferenceFrames(0);
@@ -132,6 +135,11 @@ Decode_Status VideoDecoderVP8::start(VideoConfigBuffer *buffer) {
     status = VideoDecoderBase::parseBuffer(buffer->data, buffer->size, true, (void**)&data);
     CHECK_STATUS("VideoDecoderBase::parseBuffer");
 
+    if (data->codec_data->frame_width > MAX_PICTURE_WIDTH_VP8 ||
+            data->codec_data->frame_height > MAX_PICTURE_HEIGHT_VP8) {
+        return DECODE_INVALID_DATA;
+    }
+
     status = startVA(data);
     return status;
 }
@@ -165,6 +173,11 @@ Decode_Status VideoDecoderVP8::decode(VideoDecodeBuffer *buffer) {
                  (void**)&data);
     CHECK_STATUS("VideoDecoderBase::parseBuffer");
 
+    if (data->codec_data->frame_width > MAX_PICTURE_WIDTH_VP8 ||
+            data->codec_data->frame_height > MAX_PICTURE_HEIGHT_VP8) {
+        return DECODE_INVALID_DATA;
+    }
+
     mShowFrame = data->codec_data->show_frame;
 
     if (!mVAStarted) {
diff --git a/videodecoder/VideoDecoderWMV.cpp b/videodecoder/VideoDecoderWMV.cpp
index 88b09b3..bd55888 100644
--- a/videodecoder/VideoDecoderWMV.cpp
+++ b/videodecoder/VideoDecoderWMV.cpp
@@ -18,6 +18,9 @@
 #include "VideoDecoderTrace.h"
 #include <string.h>
 
+#define MAX_PICTURE_WIDTH_VC1   1920
+#define MAX_PICTURE_HEIGHT_VC1  1088
+
 VideoDecoderWMV::VideoDecoderWMV(const char *mimeType)
     : VideoDecoderBase(mimeType, VBP_VC1),
       mBufferIDs(NULL),
@@ -49,6 +52,11 @@ Decode_Status VideoDecoderWMV::start(VideoConfigBuffer *buffer) {
     status = parseBuffer(buffer->data, buffer->size, &data);
     CHECK_STATUS("parseBuffer");
 
+    if (data->se_data->CODED_WIDTH > MAX_PICTURE_WIDTH_VC1 ||
+            data->se_data->CODED_HEIGHT > MAX_PICTURE_HEIGHT_VC1) {
+        return DECODE_INVALID_DATA;
+    }
+
     status = startVA(data);
     return status;
 }
@@ -89,6 +97,11 @@ Decode_Status VideoDecoderWMV::decode(VideoDecodeBuffer *buffer) {
     status = parseBuffer(buffer->data, buffer->size, &data);
     CHECK_STATUS("parseBuffer");
 
+    if (data->se_data->CODED_WIDTH > MAX_PICTURE_WIDTH_VC1 ||
+            data->se_data->CODED_HEIGHT > MAX_PICTURE_HEIGHT_VC1) {
+        return DECODE_INVALID_DATA;
+    }
+
     if (!mVAStarted) {
         status = startVA(data);
         CHECK_STATUS("startVA");