mpeg4dec: Check for invalid quant matrix
Add a check to ensure quant matrix has at least one non-zero
value parsed.
Bug: 173320193
Test: poc in bug
Test: atest Mpeg4H263DecoderTest -- \
--enable-module-dynamic-download=true
Test: atest android.mediav2.cts
Test: atest android.media.cts
Merged-In: I76312e46dbf26d666b634f67ba840b01603ca8e5
Change-Id: Ic906ea4833eab1d8a31767f963389b84fe23a006
diff --git a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
index a11f55e..f4b3888 100644
--- a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
+++ b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
@@ -501,6 +501,13 @@
}
while ((qmat[*(zigzag_inv+i)] != 0) && (++i < 64));
+ /* qmatrix must have at least one non-zero value, which means
+ i would be non-zero in valid cases */
+ if (i == 0)
+ {
+ return PV_FAIL;
+ }
+
for (j = i; j < 64; j++)
qmat[*(zigzag_inv+j)] = qmat[*(zigzag_inv+i-1)];
}
@@ -524,6 +531,13 @@
}
while ((qmat[*(zigzag_inv+i)] != 0) && (++i < 64));
+ /* qmatrix must have at least one non-zero value, which means
+ i would be non-zero in valid cases */
+ if (i == 0)
+ {
+ return PV_FAIL;
+ }
+
for (j = i; j < 64; j++)
qmat[*(zigzag_inv+j)] = qmat[*(zigzag_inv+i-1)];
}