Decoder: Fixes an out of bound write in bitstream buffer
[for mnc-dr-dev and later; mnc-dev gets a different patch]
After emulation prevention, data is written as an int,
so at least 3 additional bytes should be available.
And since bitstream functions read 8 bytes ahead, 8 extra bytes
should be available in the bitstream buffer.
Bug: 33934721
Change-Id: I444ec6f85d01b0bade9f827e15c4b476779d6c69
diff --git a/decoder/ih264d_api.c b/decoder/ih264d_api.c
index 5b6c7c1..dbf7030 100644
--- a/decoder/ih264d_api.c
+++ b/decoder/ih264d_api.c
@@ -1956,7 +1956,9 @@
if(buflen == -1)
buflen = 0;
/* Ignore bytes beyond the allocated size of intermediate buffer */
- buflen = MIN(buflen, buf_size);
+ /* Since 8 bytes are read ahead, ensure 8 bytes are free at the
+ end of the buffer, which will be memset to 0 after emulation prevention */
+ buflen = MIN(buflen, buf_size - 8);
bytes_consumed = buflen + u4_length_of_start_code;
ps_dec_op->u4_num_bytes_consumed += bytes_consumed;