diff options
author | Jessica Wagantall <jwagantall@cyngn.com> | 2016-11-09 11:51:30 -0800 |
---|---|---|
committer | Jessica Wagantall <jwagantall@cyngn.com> | 2016-11-09 11:58:46 -0800 |
commit | 26c5fa31d17a638bf314de6e12e86bb8a86db44b (patch) | |
tree | bdc7f3eeafcd04c5194bec6e8f3f2892a52432a0 /media/libstagefright/MPEG4Extractor.cpp | |
parent | 1c6e16c0b4082c0edaca4fcc0838f33bf14ffac8 (diff) | |
parent | c13a507aa0badeb5f8482c25e2845780ba021ce7 (diff) | |
download | frameworks_av-26c5fa31d17a638bf314de6e12e86bb8a86db44b.zip frameworks_av-26c5fa31d17a638bf314de6e12e86bb8a86db44b.tar.gz frameworks_av-26c5fa31d17a638bf314de6e12e86bb8a86db44b.tar.bz2 |
Merge tag 'android-6.0.1_r74' into HEAD
CYNGNOS-3303
Android 6.0.1 release 74
Change-Id: I0a14578751f4ecb8d13def26b9ffe5dcba4afd72
Diffstat (limited to 'media/libstagefright/MPEG4Extractor.cpp')
-rwxr-xr-x | media/libstagefright/MPEG4Extractor.cpp | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index 89b561e..80ef7b7 100755 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -50,6 +50,12 @@ namespace android { +enum { + // maximum size of an atom. Some atoms can be bigger according to the spec, + // but we only allow up to this size. + kMaxAtomSize = 64 * 1024 * 1024, +}; + class MPEG4Source : public MediaSource { public: // Caller retains ownership of both "dataSource" and "sampleTable". @@ -845,6 +851,13 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { PathAdder autoAdder(&mPath, chunk_type); off64_t chunk_data_size = *offset + chunk_size - data_offset; + if (chunk_type != FOURCC('m', 'd', 'a', 't') && chunk_data_size > kMaxAtomSize) { + char errMsg[100]; + sprintf(errMsg, "%s atom has size %" PRId64, chunk, chunk_data_size); + ALOGE("%s (b/28615448)", errMsg); + android_errorWriteWithInfoLog(0x534e4554, "28615448", -1, errMsg, strlen(errMsg)); + return ERROR_MALFORMED; + } if (chunk_type != FOURCC('c', 'p', 'r', 't') && chunk_type != FOURCC('c', 'o', 'v', 'r') |