Code: u32 h264bsdInit(storage_t *pStorage, u32 noOutputReordering)
{

/* Variables */
    u32 size;
/* Code */

    ASSERT(pStorage);

    h264bsdInitStorage(pStorage);

 /* allocate mbLayer to be next multiple of 64 to enable use of

      * specific NEON optimized "memset" for clearing the structure */
     size = (sizeof(macroblockLayer_t) + 63) & ~0x3F;
 
    pStorage->mbLayer = (macroblockLayer_t*)H264SwDecMalloc(size);
     if (!pStorage->mbLayer)
         return HANTRO_NOK;
 
 if (noOutputReordering)
        pStorage->noReordering = HANTRO_TRUE;

 return HANTRO_OK;
}

Vulnerability Type: DoS Exec Code Overflow Mem. Corr. 
CWE ID: CWE-119
Summary: Multiple integer overflows in the h264dec component in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation, aka internal bug 27855419.
Commit Message: h264dec: check for overflows when calculating allocation size.

Bug: 27855419
Change-Id: Idabedca52913ec31ea5cb6a6109ab94e3fb2badd
