commit 4a8f9e81f1a3a68997640901c9609ac4aea70f8b
author Ray Essick Fri Dec 18 17:41:32 2020 -0800
committer Ray Essick Fri Dec 18 17:41:32 2020 -0800
tree 9633cc178c127330fa2172e9ffe70ae2299af2d5
parent 6bb359e9d72d6ba6334cd549cceadc78e251867d

m4v_h263: Add check on the encode dimension

Test: poc in bug description

Bug: 172716941
Bug: 172718133
Bug: 173042552

Merged-In: Id32ee0585a4188f3b303d7f2f83793d7ab8152da
Change-Id: I0426e59a6327338cfc7b03625f24694753b0f1e0

media/libstagefright/codecs/m4v_h263/enc/src/mp4enc_api.cpp

diff --git a/media/libstagefright/codecs/m4v_h263/enc/src/mp4enc_api.cpp b/media/libstagefright/codecs/m4v_h263/enc/src/mp4enc_api.cpp
index 7ab8f45..30e4fda 100644
--- a/media/libstagefright/codecs/m4v_h263/enc/src/mp4enc_api.cpp
+++ b/media/libstagefright/codecs/m4v_h263/enc/src/mp4enc_api.cpp
@@ -491,6 +491,9 @@
     }
     for (i = 0; i < encParams->nLayers; i++)
     {
+        if (encOption->encHeight[i] == 0 || encOption->encWidth[i] == 0 ||
+                encOption->encHeight[i] % 16 != 0 || encOption->encWidth[i] % 16 != 0)
+            goto CLEAN_UP;
         encParams->LayerHeight[i] = encOption->encHeight[i];
         encParams->LayerWidth[i] = encOption->encWidth[i];
     }