am 3674abc0: am fb0d63df: am 62d89908: am df68d9d5: am 60b25aa0: am 9ab9c85e: Merge "MPEG4Extractor: ensure buffer size is not less than 8 for LastCommentData." into klp-dev

* commit '3674abc050997e664c3906b8507d9d4b63d52e9d':
  MPEG4Extractor: ensure buffer size is not less than 8 for LastCommentData.

1 files changed, 6 insertions, 0 deletions

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 08e989b..96423e6 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -2355,6 +2355,12 @@ status_t MPEG4Extractor::parseITunesMetaData(off64_t offset, size_t size) {
                     mLastCommentName.setTo((const char *)buffer + 4);
                     break;
                 case FOURCC('d', 'a', 't', 'a'):
+                    if (size < 8) {
+                        delete[] buffer;
+                        buffer = NULL;
+                        ALOGE("b/24346430");
+                        return ERROR_MALFORMED;
+                    }
                     mLastCommentData.setTo((const char *)buffer + 8);
                     break;
             }