commit 84a4221e305847fb0c8846122fe8f2bc7c2fda0a
author Wei Jia <wjia@google.com> Thu Aug 20 04:16:58 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Thu Aug 20 04:16:58 2015 +0000
tree 456fb68735b6b57ba60abe511c771ace336c9fd6
parent 096a931e5a0d5f45c3546b09046912b4d54136c8
parent a9b3cd3c101b68522a3d8492cb3a19d8b5409329

am a9b3cd3c: am 5221133b: am b2ae4351: libstagefright: fix overflow in pvdec_api.cpp.

* commit 'a9b3cd3c101b68522a3d8492cb3a19d8b5409329':
  libstagefright: fix overflow in pvdec_api.cpp.

media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp

diff --git a/media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp b/media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp
index 419e3f4..30d5cbd 100644
--- a/media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp
+++ b/media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp
@@ -338,7 +338,7 @@
     video->prevVop->uChan = video->prevVop->yChan + size;
     video->prevVop->vChan = video->prevVop->uChan + (size >> 2);
 #else
-    if (size > INT32_MAX / 3 * 2) {
+    if (size > INT32_MAX / 3) {
         return PV_FALSE;
     }
     video->currVop->yChan = (PIXEL *) oscl_malloc(size * 3 / 2); /* Allocate memory for all VOP OKA 3/2/1*/
@@ -368,7 +368,7 @@
         {
             oscl_memset(video->prevEnhcVop, 0, sizeof(Vop));
 #ifndef PV_MEMORY_POOL
-            if (size > INT32_MAX / 3 * 2) {
+            if (size > INT32_MAX / 3) {
                 return PV_FALSE;
             }