Code: void impeg2d_next_code(dec_state_t *ps_dec, UWORD32 u4_start_code_val)
{
 stream_t *ps_stream;

     ps_stream = &ps_dec->s_bit_stream;
     impeg2d_bit_stream_flush_to_byte_boundary(ps_stream);
 
    while ((impeg2d_bit_stream_nxt(ps_stream,START_CODE_LEN) != u4_start_code_val)
        && (ps_dec->s_bit_stream.u4_offset <= ps_dec->s_bit_stream.u4_max_offset))
     {
 
         if (impeg2d_bit_stream_get(ps_stream,8) != 0)
 {
 /* Ignore stuffing bit errors. */
 }

 }
 return;
}

Vulnerability Type: Bypass +Info 
CWE ID: CWE-254
Summary: libmpeg2 in libstagefright in Android 6.x before 2016-03-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via crafted Bitstream data, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 25765591.
Commit Message: Fixed bit stream access to make sure that it is not read beyond the allocated size.

Bug: 25765591

Change-Id: I98c23a3c3f84f6710f29bffe5ed73adcf51d47f6
