diff options
| author | Austin Hu <austin.hu@intel.com> | 2017-05-11 16:30:11 +0800 |
|---|---|---|
| committer | Daniel Cardenas <danielcar@google.com> | 2017-05-16 14:32:08 -0700 |
| commit | c32764350c8f66fcb9e17cd1ba70869da68ea62a (patch) | |
| tree | 39539b5ee6fea07664edd2680ebc003794c4a925 /videodecoder/VideoDecoderAVC.cpp | |
| parent | 42162bacfad5d5b6cd58dad8d2a1f810ded8ca88 (diff) | |
| download | libmix-c32764350c8f66fcb9e17cd1ba70869da68ea62a.tar.gz | |
Reject bad resolution for security issueandroid-vts-8.0_r2android-vts-8.0_r1oreo-dev
BZ: IMINAN-51493
Fixes: 38180135
Test: adb shell stagefright /sdcard/mpeg2-1.mp4
Test: netflix, play movies, youtube
Change-Id: Id20df74bb9957a472d7e412d257ebc1d27a2023e
Signed-off-by: Austin Hu <austin.hu@intel.com>
(cherry picked from commit 4216c5c686f07d42113c5779ecb911b1a944383b)
Diffstat (limited to 'videodecoder/VideoDecoderAVC.cpp')
| -rw-r--r-- | videodecoder/VideoDecoderAVC.cpp | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/videodecoder/VideoDecoderAVC.cpp b/videodecoder/VideoDecoderAVC.cpp index f0e047e..a9ddc8b 100644 --- a/videodecoder/VideoDecoderAVC.cpp +++ b/videodecoder/VideoDecoderAVC.cpp @@ -25,6 +25,9 @@ #define NW_CONSUMED 2 #define POC_DEFAULT 0x7FFFFFFF +#define MAX_PICTURE_WIDTH_AVC 4096 +#define MAX_PICTURE_HEIGHT_AVC 4096 + VideoDecoderAVC::VideoDecoderAVC(const char *mimeType) : VideoDecoderBase(mimeType, VBP_H264), mToggleDPB(0), @@ -65,6 +68,11 @@ Decode_Status VideoDecoderAVC::start(VideoConfigBuffer *buffer) { status = VideoDecoderBase::parseBuffer(buffer->data, buffer->size, true, (void**)&data); CHECK_STATUS("VideoDecoderBase::parseBuffer"); + if (data->codec_data->frame_width > MAX_PICTURE_WIDTH_AVC || + data->codec_data->frame_height > MAX_PICTURE_HEIGHT_AVC) { + return DECODE_INVALID_DATA; + } + status = startVA(data); return status; } @@ -102,6 +110,11 @@ Decode_Status VideoDecoderAVC::decode(VideoDecodeBuffer *buffer) { (void**)&data); CHECK_STATUS("VideoDecoderBase::parseBuffer"); + if (data->codec_data->frame_width > MAX_PICTURE_WIDTH_AVC || + data->codec_data->frame_height > MAX_PICTURE_HEIGHT_AVC) { + return DECODE_INVALID_DATA; + } + if (!mVAStarted) { if (data->has_sps && data->has_pps) { status = startVA(data); |