diff options
| author | Joshua J. Drake <android-open-source@qoop.org> | 2015-05-04 18:29:08 -0500 |
|---|---|---|
| committer | Paul Kocialkowski <contact@paulk.fr> | 2015-08-31 00:22:02 +0200 |
| commit | ec6cff83536f54f1270a335e373caad76bdb8aa7 (patch) | |
| tree | 900a86dd1db275c481d2289fd341cfc597c885a8 /camera/ICamera.cpp | |
| parent | c40f2dc30a7e33526460750e43325a947845b4fb (diff) | |
| download | frameworks_av-ec6cff83536f54f1270a335e373caad76bdb8aa7.zip frameworks_av-ec6cff83536f54f1270a335e373caad76bdb8aa7.tar.gz frameworks_av-ec6cff83536f54f1270a335e373caad76bdb8aa7.tar.bz2 | |
Fix integer overflow when handling MPEG4 tx3g atom
When the sum of the 'size' and 'chunk_size' variables is larger than 2^32,
an integer overflow occurs. Using the result value to allocate memory
leads to an undersized buffer allocation and later a potentially
exploitable heap corruption condition. Ensure that integer overflow does
not occur.
Bug: 20923261
Change-Id: Id050a36b33196864bdd98b5ea24241f95a0b5d1f
Signed-off-by: Joshua J. Drake <android-open-source@qoop.org>
Tested-by: Moritz Bandemer <replicant@posteo.mx>
Diffstat (limited to 'camera/ICamera.cpp')
0 files changed, 0 insertions, 0 deletions