commit 717ad3d1cf34f7dfcc93bf86870e162596ff4574
author android-build-team Robot <android-build-team-robot@google.com> Sat Aug 03 23:13:35 2019 +0000
committer android-build-team Robot <android-build-team-robot@google.com> Sat Aug 03 23:13:35 2019 +0000
tree 689aba49c17cfd525c850ab75333d36bcaef1dfe
parent 2237f726ad04dda40debdae9017f761c3d9d5ac2
parent 393728a945cdaa5e415350c257d474eb52af887b

Snap for 5778854 from 393728a945cdaa5e415350c257d474eb52af887b to qt-c2f2-release

Change-Id: Ie9a3f9e52efb6be20d5ba23da5d9bb08c3f85ac2

media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp

diff --git a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
index f18f789..679b091 100644
--- a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
+++ b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
@@ -1355,6 +1355,14 @@
             int tmpHeight = (tmpDisplayHeight + 15) & -16;
             int tmpWidth = (tmpDisplayWidth + 15) & -16;
 
+            if (tmpWidth > video->width)
+            {
+                // while allowed by the spec, this decoder does not actually
+                // support an increase in size.
+                ALOGE("width increase not supported");
+                status = PV_FAIL;
+                goto return_point;
+            }
             if (tmpHeight * tmpWidth > video->size)
             {
                 // This is just possibly "b/37079296".