diff options
| author | Joshua J. Drake <android-open-source@qoop.org> | 2015-08-04 21:25:40 +0000 |
|---|---|---|
| committer | Android Git Automerger <android-git-automerger@android.com> | 2015-08-04 21:25:40 +0000 |
| commit | 03d539a7a9c8ae7aef9cb8bda9042187327566a2 (patch) | |
| tree | 1d148ff7d9f31fe31e5d297b5f6202be179299a5 /media/libstagefright/MPEG4Extractor.cpp | |
| parent | 52d1defcfe51bd3b5f4e191fb70a0a0a406c33dc (diff) | |
| parent | a5b9055d7ce1d82ee29ed2f45aa4f8a82ccc76f2 (diff) | |
| download | frameworks_av-03d539a7a9c8ae7aef9cb8bda9042187327566a2.zip frameworks_av-03d539a7a9c8ae7aef9cb8bda9042187327566a2.tar.gz frameworks_av-03d539a7a9c8ae7aef9cb8bda9042187327566a2.tar.bz2 | |
am a5b9055d: am f1ce97dd: Fix integer overflow when handling MPEG4 tx3g atom
* commit 'a5b9055d7ce1d82ee29ed2f45aa4f8a82ccc76f2':
Fix integer overflow when handling MPEG4 tx3g atom
Diffstat (limited to 'media/libstagefright/MPEG4Extractor.cpp')
| -rw-r--r-- | media/libstagefright/MPEG4Extractor.cpp | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index d1f25f6..ec6ca16 100644 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -1398,7 +1398,14 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { size = 0; } + if (SIZE_MAX - chunk_size <= size) { + return ERROR_MALFORMED; + } + uint8_t *buffer = new uint8_t[size + chunk_size]; + if (buffer == NULL) { + return ERROR_MALFORMED; + } if (size > 0) { memcpy(buffer, data, size); |