1 files changed, 13 insertions, 0 deletions
diff --git a/videodecoder/VideoDecoderMPEG4.cpp b/videodecoder/VideoDecoderMPEG4.cpp
index 6472446..51543ab 100644
--- a/videodecoder/VideoDecoderMPEG4.cpp
+++ b/videodecoder/VideoDecoderMPEG4.cpp
@@ -18,6 +18,9 @@
 #include "VideoDecoderTrace.h"
 #include <string.h>
 
+#define MAX_PICTURE_WIDTH_MPEG4   1920
+#define MAX_PICTURE_HEIGHT_MPEG4  1088
+
 VideoDecoderMPEG4::VideoDecoderMPEG4(const char *mimeType)
     : VideoDecoderBase(mimeType, VBP_MPEG4),
       mLastVOPTimeIncrement(0),
@@ -46,6 +49,11 @@ Decode_Status VideoDecoderMPEG4::start(VideoConfigBuffer *buffer) {
     status = VideoDecoderBase::parseBuffer(buffer->data, buffer->size, true, (void**)&data);
     CHECK_STATUS("VideoDecoderBase::parseBuffer");
 
+    if (data->codec_data.video_object_layer_width > MAX_PICTURE_WIDTH_MPEG4 ||
+            data->codec_data.video_object_layer_height > MAX_PICTURE_HEIGHT_MPEG4) {
+        return DECODE_INVALID_DATA;
+    }
+
     status = startVA(data);
     return status;
 }
@@ -80,6 +88,11 @@ Decode_Status VideoDecoderMPEG4::decode(VideoDecodeBuffer *buffer) {
             (void**)&data);
     CHECK_STATUS("VideoDecoderBase::parseBuffer");
 
+    if (data->codec_data.video_object_layer_width > MAX_PICTURE_WIDTH_MPEG4 ||
+            data->codec_data.video_object_layer_height > MAX_PICTURE_HEIGHT_MPEG4) {
+        return DECODE_INVALID_DATA;
+    }
+
     if (!mVAStarted) {
         status = startVA(data);
         CHECK_STATUS("startVA");