commit 5d8def9a0235d97fd6dfd88fb8b6b25bf98411c5
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Fri Apr 10 04:31:59 2020 +0530
committer Ray Essick <essick@google.com> Fri Apr 10 21:24:18 2020 -0700
tree 019da8ecb1dc0f643cc5606194399ad7850b86d3
parent 4bbfb6d8815002fc79b26aebba5f3ad2226c468e

m4v_h263: Return error for zero width and height

Test: poc in bug
Bug: 152496149
Bug: 152629190

Change-Id: I07293e97b664e03e29a1392b139132fc137361cd

media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp

diff --git a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
index 679b091..a11f55e 100644
--- a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
+++ b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
@@ -409,7 +409,9 @@
         if (!BitstreamRead1Bits(stream)) return PV_FAIL;
 
         /* video_object_layer_width (13 bits) */
-        video->displayWidth = video->width = (int) BitstreamReadBits16(stream, 13);
+        tmpvar = BitstreamReadBits16(stream, 13);
+        if (!tmpvar) return PV_FAIL;
+        video->displayWidth = video->width = tmpvar;
 
         /* round up to a multiple of MB_SIZE.   08/09/2000 */
         video->width = (video->width + 15) & -16;
@@ -419,7 +421,9 @@
         if (!BitstreamRead1Bits(stream)) return PV_FAIL;
 
         /* video_object_layer_height (13 bits) */
-        video->displayHeight = video->height = (int) BitstreamReadBits16(stream, 13);
+        tmpvar = BitstreamReadBits16(stream, 13);
+        if (!tmpvar) return PV_FAIL;
+        video->displayHeight = video->height = tmpvar;
 
         /* round up to a multiple of MB_SIZE.   08/09/2000 */
         video->height = (video->height + 15) & -16;