Code: INLINE UWORD8 impeg2d_bit_stream_get_bit(stream_t *ps_stream)
{
    UWORD32     u4_bit,u4_offset,u4_temp;
    UWORD32     u4_curr_bit;

    u4_offset               = ps_stream->u4_offset;
    u4_curr_bit             = u4_offset & 0x1F;
    u4_bit                  = ps_stream->u4_buf;

 /* Move the current bit read from the current word to the
       least significant bit positions of 'c'.*/
    u4_bit                  >>= BITS_IN_INT - u4_curr_bit - 1;

    u4_offset++;

 /* If the last bit of the last word of the buffer has been read update
       the currrent buf with next, and read next buf from bit stream buffer */

     if (u4_curr_bit == 31)
     {
         ps_stream->u4_buf      = ps_stream->u4_buf_nxt;
        u4_temp             = *(ps_stream->pu4_buf_aligned)++;
 
        CONV_LE_TO_BE(ps_stream->u4_buf_nxt,u4_temp)
     }
     ps_stream->u4_offset          = u4_offset;
 
 return (u4_bit & 0x1);
}

Vulnerability Type: Bypass +Info 
CWE ID: CWE-254
Summary: libmpeg2 in libstagefright in Android 6.x before 2016-03-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via crafted Bitstream data, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 25765591.
Commit Message: Fixed bit stream access to make sure that it is not read beyond the allocated size.

Bug: 25765591

Change-Id: I98c23a3c3f84f6710f29bffe5ed73adcf51d47f6
