commit 5bc433ba6c8b828e574891bed54ffb7c100ea765
author Treehugger Robot <treehugger-gerrit@google.com> Sat Dec 05 00:12:04 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Sat Dec 05 00:12:04 2020 +0000
tree 945a39cfa64bcd1576a77b1f2f06426d9fa0f503
parent 1d5300615c3afff3397a57f72d029f284ccb9059
parent be78d20a39da3c48e906710b4e5868d670781066

Merge "mpeg4dec: Check for invalid quant matrix" am: be78d20a39

Original change: https://android-review.googlesource.com/c/platform/frameworks/av/+/1505733

Change-Id: I1c8cbe3813dd7f10815bfc3b6cf9e79fd9eabcec

media/codecs/m4v_h263/dec/src/vop.cpp

diff --git a/media/codecs/m4v_h263/dec/src/vop.cpp b/media/codecs/m4v_h263/dec/src/vop.cpp
index 335846c..7b32498 100644
--- a/media/codecs/m4v_h263/dec/src/vop.cpp
+++ b/media/codecs/m4v_h263/dec/src/vop.cpp
@@ -497,6 +497,13 @@
                 }
                 while ((qmat[*(zigzag_inv+i)] != 0) && (++i < 64));
 
+                /* qmatrix must have at least one non-zero value, which means
+                   i would be non-zero in valid cases */
+                if (i == 0)
+                {
+                    return PV_FAIL;
+                }
+
                 for (j = i; j < 64; j++)
                     qmat[*(zigzag_inv+j)] = qmat[*(zigzag_inv+i-1)];
             }
@@ -520,6 +527,13 @@
                 }
                 while ((qmat[*(zigzag_inv+i)] != 0) && (++i < 64));
 
+                /* qmatrix must have at least one non-zero value, which means
+                   i would be non-zero in valid cases */
+                if (i == 0)
+                {
+                    return PV_FAIL;
+                }
+
                 for (j = i; j < 64; j++)
                     qmat[*(zigzag_inv+j)] = qmat[*(zigzag_inv+i-1)];
             }