diff options
author | Jessica Wagantall <jwagantall@cyngn.com> | 2016-07-07 12:07:33 -0700 |
---|---|---|
committer | Jessica Wagantall <jwagantall@cyngn.com> | 2016-07-07 14:15:22 -0700 |
commit | 1e7c9d2c408b17fa14f897cfe8d1ae06fe944637 (patch) | |
tree | 2e132ad77cb30013947b94eeb8d4835bbd01f664 /media/libstagefright/DRMExtractor.cpp | |
parent | fbef511c958b5f1b3e015d032dcac4ed7cc84876 (diff) | |
parent | d112f7d0c1dbaf0368365885becb11ca8d3f13a4 (diff) | |
download | frameworks_av-1e7c9d2c408b17fa14f897cfe8d1ae06fe944637.zip frameworks_av-1e7c9d2c408b17fa14f897cfe8d1ae06fe944637.tar.gz frameworks_av-1e7c9d2c408b17fa14f897cfe8d1ae06fe944637.tar.bz2 |
Merge remote-tracking branch 'remotes/android-6.0.1_r52' into HEAD
Ticket: CYNGNOS-3020
Change-Id: I7e8d69c5f7041b66893ea643c4bc19c3b7bcdda5
Diffstat (limited to 'media/libstagefright/DRMExtractor.cpp')
-rw-r--r-- | media/libstagefright/DRMExtractor.cpp | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/media/libstagefright/DRMExtractor.cpp b/media/libstagefright/DRMExtractor.cpp index 9cb6e86..e2bc89c 100644 --- a/media/libstagefright/DRMExtractor.cpp +++ b/media/libstagefright/DRMExtractor.cpp @@ -200,7 +200,17 @@ status_t DRMSource::read(MediaBuffer **buffer, const ReadOptions *options) { continue; } - CHECK(dstOffset + 4 <= (*buffer)->size()); + if (dstOffset > SIZE_MAX - 4 || + dstOffset + 4 > SIZE_MAX - nalLength || + dstOffset + 4 + nalLength > (*buffer)->size()) { + (*buffer)->release(); + (*buffer) = NULL; + if (decryptedDrmBuffer.data) { + delete [] decryptedDrmBuffer.data; + decryptedDrmBuffer.data = NULL; + } + return ERROR_MALFORMED; + } dstData[dstOffset++] = 0; dstData[dstOffset++] = 0; |