Code: IMPEG2D_ERROR_CODES_T impeg2d_dec_pic_hdr(dec_state_t *ps_dec)
{
 stream_t *ps_stream;
    ps_stream = &ps_dec->s_bit_stream;

    impeg2d_bit_stream_flush(ps_stream,START_CODE_LEN);
 /* Flush temporal reference */
    impeg2d_bit_stream_get(ps_stream,10);

 /* Picture type */
    ps_dec->e_pic_type = (e_pic_type_t)impeg2d_bit_stream_get(ps_stream,3);
 if((ps_dec->e_pic_type < I_PIC) || (ps_dec->e_pic_type > D_PIC))
 {
        impeg2d_next_code(ps_dec, PICTURE_START_CODE);
 return IMPEG2D_INVALID_PIC_TYPE;
 }

 /* Flush vbv_delay */
    impeg2d_bit_stream_get(ps_stream,16);

 if(ps_dec->e_pic_type == P_PIC || ps_dec->e_pic_type == B_PIC)
 {
        ps_dec->u2_full_pel_forw_vector = impeg2d_bit_stream_get_bit(ps_stream);
        ps_dec->u2_forw_f_code          = impeg2d_bit_stream_get(ps_stream,3);
 }
 if(ps_dec->e_pic_type == B_PIC)
 {
        ps_dec->u2_full_pel_back_vector = impeg2d_bit_stream_get_bit(ps_stream);
        ps_dec->u2_back_f_code          = impeg2d_bit_stream_get(ps_stream,3);
 }

 
     if(ps_dec->u2_is_mpeg2 == 0)
     {
         ps_dec->au2_f_code[0][0] = ps_dec->au2_f_code[0][1] = ps_dec->u2_forw_f_code;
         ps_dec->au2_f_code[1][0] = ps_dec->au2_f_code[1][1] = ps_dec->u2_back_f_code;
     }

 /*-----------------------------------------------------------------------*/
 /*  Flush the extra bit value                                            */
 /*                                                                       */
 /*  while(impeg2d_bit_stream_nxt() == '1')                                  */
 /*  {                                                                    */
 /*      extra_bit_picture         1                                      */
 /*      extra_information_picture 8                                      */
 /*  }                                                                    */
 /*  extra_bit_picture             1                                      */
 /*-----------------------------------------------------------------------*/
 while (impeg2d_bit_stream_nxt(ps_stream,1) == 1 &&
           ps_stream->u4_offset < ps_stream->u4_max_offset)
 {
        impeg2d_bit_stream_get(ps_stream,9);
 }
    impeg2d_bit_stream_get_bit(ps_stream);
    impeg2d_next_start_code(ps_dec);

 return (IMPEG2D_ERROR_CODES_T)IVD_ERROR_NONE;
}

Vulnerability Type: +Info 
CWE ID: CWE-200
Summary: An information disclosure vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-64550583.
Commit Message: Adding Error Check for f_code Parameters

In MPEG1, the valid range for the forward and backward f_code parameters
is [1, 7]. Adding a check to enforce this. Without the check, the value
could be 0. We read (f_code - 1) bits from the stream and reading a
negative number of bits from the stream is undefined.

Bug: 64550583
Test: monitored temp ALOGD() output
Change-Id: Ia452cd43a28e9d566401f515947164635361782f
(cherry picked from commit 71d734b83d72e8a59f73f1230982da97615d2689)
