Code:  status_t HevcParameterSets::addNalUnit(const uint8_t* data, size_t size) {
     uint8_t nalUnitType = (data[0] >> 1) & 0x3f;
     status_t err = OK;
     switch (nalUnitType) {
         case 32:  // VPS
             err = parseVps(data + 2, size - 2);
             break;
         case 33:  // SPS
             err = parseSps(data + 2, size - 2);
             break;
         case 34:  // PPS
             err = parsePps(data + 2, size - 2);
             break;
         case 39:  // Prefix SEI
 case 40: // Suffix SEI
 break;
 default:
            ALOGE("Unrecognized NAL unit type.");
 return ERROR_MALFORMED;
 }

 if (err != OK) {
 return err;
 }

    sp<ABuffer> buffer = ABuffer::CreateAsCopy(data, size);
    buffer->setInt32Data(nalUnitType);
    mNalUnits.push(buffer);
 return OK;
}

Vulnerability Type: DoS 
CWE ID: CWE-476
Summary: A remote denial of service vulnerability in HevcUtils.cpp in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as Low due to details specific to the vulnerability. Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-35467107.
Commit Message: Validate lengths in HEVC metadata parsing

Add code to validate the size parameter passed to
HecvParameterSets::addNalUnit().  Previously vulnerable
to decrementing an unsigned past 0, yielding a huge result value.

Bug: 35467107
Test: ran POC, no crash, emitted new "bad length" log entry
Change-Id: Ia169b9edc1e0f7c5302e3c68aa90a54e8863d79e
(cherry picked from commit e0dcf097cc029d056926029a29419e1650cbdf1b)
