diff options
| author | Robert Shih <robertshih@google.com> | 2015-08-22 00:54:32 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2015-08-22 00:54:32 +0000 |
| commit | 3b42241aab5855964d1bd60268ae21c2d9cc6065 (patch) | |
| tree | 26b23cae8b66ba01e49d516e1ee7a19519dc949a | |
| parent | d8816a13dbcafd5d61d26a8a6b2e892452bca1a7 (diff) | |
| parent | c580c836c1941fb4912e1dd4e08626caf98a62c7 (diff) | |
| download | frameworks_av-3b42241aab5855964d1bd60268ae21c2d9cc6065.zip frameworks_av-3b42241aab5855964d1bd60268ae21c2d9cc6065.tar.gz frameworks_av-3b42241aab5855964d1bd60268ae21c2d9cc6065.tar.bz2 | |
Merge "Prevent integer issues in ID3::Iterator::findFrame" into klp-dev
| -rw-r--r-- | media/libstagefright/id3/ID3.cpp | 23 |
1 files changed, 21 insertions, 2 deletions
diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp index 751b810..5a490e9 100644 --- a/media/libstagefright/id3/ID3.cpp +++ b/media/libstagefright/id3/ID3.cpp @@ -659,6 +659,11 @@ void ID3::Iterator::findFrame() { mFrameSize += 6; + // Prevent integer overflow in validation + if (SIZE_MAX - mOffset <= mFrameSize) { + return; + } + if (mOffset + mFrameSize > mParent.mSize) { ALOGV("partial frame at offset %d (size = %d, bytes-remaining = %d)", mOffset, mFrameSize, mParent.mSize - mOffset - 6); @@ -688,7 +693,7 @@ void ID3::Iterator::findFrame() { return; } - size_t baseSize; + size_t baseSize = 0; if (mParent.mVersion == ID3_V2_4) { if (!ParseSyncsafeInteger( &mParent.mData[mOffset + 4], &baseSize)) { @@ -698,7 +703,21 @@ void ID3::Iterator::findFrame() { baseSize = U32_AT(&mParent.mData[mOffset + 4]); } - mFrameSize = 10 + baseSize; + if (baseSize == 0) { + return; + } + + // Prevent integer overflow when adding + if (SIZE_MAX - 10 <= baseSize) { + return; + } + + mFrameSize = 10 + baseSize; // add tag id, size field and flags + + // Prevent integer overflow in validation + if (SIZE_MAX - mOffset <= mFrameSize) { + return; + } if (mOffset + mFrameSize > mParent.mSize) { ALOGV("partial frame at offset %d (size = %d, bytes-remaining = %d)", |