1 files changed, 13 insertions, 0 deletions
diff --git a/videodecoder/VideoDecoderMPEG2.cpp b/videodecoder/VideoDecoderMPEG2.cpp
index 928ee9b..9d6a784 100644
--- a/videodecoder/VideoDecoderMPEG2.cpp
+++ b/videodecoder/VideoDecoderMPEG2.cpp
@@ -18,6 +18,9 @@
 #include "VideoDecoderTrace.h"
 #include <string.h>
 
+#define MAX_PICTURE_WIDTH_MPEG2 1920
+#define MAX_PICTURE_HEIGHT_MPEG2 1088
+
 VideoDecoderMPEG2::VideoDecoderMPEG2(const char *mimeType)
     : VideoDecoderBase(mimeType, VBP_MPEG2),
     mBufferIDs(NULL),
@@ -48,6 +51,11 @@ Decode_Status VideoDecoderMPEG2::start(VideoConfigBuffer *buffer) {
             (void**)&data);
     CHECK_STATUS("VideoDecoderBase::parseBuffer");
 
+    if (data->codec_data->frame_width > MAX_PICTURE_WIDTH_MPEG2 ||
+            data->codec_data->frame_height > MAX_PICTURE_HEIGHT_MPEG2) {
+        return DECODE_INVALID_DATA;
+    }
+
     status = startVA(data);
     return status;
 }
@@ -85,6 +93,11 @@ Decode_Status VideoDecoderMPEG2::decode(VideoDecodeBuffer *buffer) {
             (void**)&data);
     CHECK_STATUS("VideoDecoderBase::parseBuffer");
 
+    if (data->codec_data->frame_width > MAX_PICTURE_WIDTH_MPEG2 ||
+            data->codec_data->frame_height > MAX_PICTURE_HEIGHT_MPEG2) {
+        return DECODE_INVALID_DATA;
+    }
+
     if (!mVAStarted) {
         status = startVA(data);
         CHECK_STATUS("startVA");