summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorWei Jia <wjia@google.com>2015-08-18 14:32:16 -0700
committerWei Jia <wjia@google.com>2015-08-20 03:53:44 +0000
commit937c6bedd4b6e5c6cb29a238eb459047dedd3486 (patch)
treede9072b197da1e8b0e7ebe6a0ea2f162237d191d
parent916a9684295fb578f4b3c6c16b621ef201a49964 (diff)
downloadframeworks_av-937c6bedd4b6e5c6cb29a238eb459047dedd3486.zip
frameworks_av-937c6bedd4b6e5c6cb29a238eb459047dedd3486.tar.gz
frameworks_av-937c6bedd4b6e5c6cb29a238eb459047dedd3486.tar.bz2
libstagefright: fix overflow in MPEG4Source::parseSampleAuxiliaryInformationOffsets.
Bug: 23270724 Change-Id: Id7ba55c7bf6860fbfc892bbb6378aac644c82da4 (cherry picked from commit c51ab7dd82bf4e24666fc72a55e03e2f530204d5)
-rw-r--r--media/libstagefright/MPEG4Extractor.cpp20
1 files changed, 19 insertions, 1 deletions
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 0899362..116c457 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -39,6 +39,10 @@
#include <media/stagefright/MetaData.h>
#include <utils/String8.h>
+#ifndef UINT32_MAX
+#define UINT32_MAX (4294967295U)
+#endif
+
namespace android {
class MPEG4Source : public MediaSource {
@@ -2714,13 +2718,27 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets(off64_t offset, off
return ERROR_IO;
}
offset += 4;
+ if (entrycount == 0) {
+ return OK;
+ }
+ if (entrycount > UINT32_MAX / 8) {
+ return ERROR_MALFORMED;
+ }
if (entrycount > mCurrentSampleInfoOffsetsAllocSize) {
- mCurrentSampleInfoOffsets = (uint64_t*) realloc(mCurrentSampleInfoOffsets, entrycount * 8);
+ uint64_t *newPtr = (uint64_t *)realloc(mCurrentSampleInfoOffsets, entrycount * 8);
+ if (newPtr == NULL) {
+ return NO_MEMORY;
+ }
+ mCurrentSampleInfoOffsets = newPtr;
mCurrentSampleInfoOffsetsAllocSize = entrycount;
}
mCurrentSampleInfoOffsetCount = entrycount;
+ if (mCurrentSampleInfoOffsets == NULL) {
+ return OK;
+ }
+
for (size_t i = 0; i < entrycount; i++) {
if (version == 0) {
uint32_t tmp;