diff options
author | Jon Larimer <jlarimer@google.com> | 2015-08-18 14:31:25 +0000 |
---|---|---|
committer | Android Git Automerger <android-git-automerger@android.com> | 2015-08-18 14:31:25 +0000 |
commit | 6035c811849a8475697268cf71b5cf923705abe8 (patch) | |
tree | b443bf98b8899119c9d7993a5340aa1c411bd083 /media/libstagefright/MPEG4Extractor.cpp | |
parent | 0afecdebaea1982ead120a701ddd24f2b0ff3897 (diff) | |
parent | 0d46c93785e2c426be11172bec0489b698fea6c3 (diff) | |
download | frameworks_av-6035c811849a8475697268cf71b5cf923705abe8.zip frameworks_av-6035c811849a8475697268cf71b5cf923705abe8.tar.gz frameworks_av-6035c811849a8475697268cf71b5cf923705abe8.tar.bz2 |
am 0d46c937: Merge "MPEG4Source::fragmentedRead: check range before writing into buffers" into klp-dev
* commit '0d46c93785e2c426be11172bec0489b698fea6c3':
MPEG4Source::fragmentedRead: check range before writing into buffers
Diffstat (limited to 'media/libstagefright/MPEG4Extractor.cpp')
-rw-r--r-- | media/libstagefright/MPEG4Extractor.cpp | 48 |
1 files changed, 40 insertions, 8 deletions
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index 6a24062..99b08bf 100644 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -3672,6 +3672,14 @@ status_t MPEG4Source::fragmentedRead( if (!mIsAVC || mWantsNALFragments) { if (newBuffer) { + if (!isInRange((size_t)0u, mBuffer->size(), size)) { + mBuffer->release(); + mBuffer = NULL; + + ALOGE("fragmentedRead ERROR_MALFORMED size %zu", size); + return ERROR_MALFORMED; + } + ssize_t num_bytes_read = mDataSource->readAt(offset, (uint8_t *)mBuffer->data(), size); @@ -3679,7 +3687,7 @@ status_t MPEG4Source::fragmentedRead( mBuffer->release(); mBuffer = NULL; - ALOGV("i/o error"); + ALOGE("i/o error"); return ERROR_IO; } @@ -3749,18 +3757,40 @@ status_t MPEG4Source::fragmentedRead( ssize_t num_bytes_read = 0; int32_t drm = 0; bool usesDRM = (mFormat->findInt32(kKeyIsDRM, &drm) && drm != 0); + void *data = NULL; + bool isMalFormed = false; if (usesDRM) { - num_bytes_read = - mDataSource->readAt(offset, (uint8_t*)mBuffer->data(), size); + if (mBuffer == NULL || !isInRange((size_t)0u, mBuffer->size(), size)) { + isMalFormed = true; + } else { + data = mBuffer->data(); + } } else { - num_bytes_read = mDataSource->readAt(offset, mSrcBuffer, size); + int32_t max_size; + if (mFormat == NULL + || !mFormat->findInt32(kKeyMaxInputSize, &max_size) + || !isInRange((size_t)0u, (size_t)max_size, size)) { + isMalFormed = true; + } else { + data = mSrcBuffer; + } } + if (isMalFormed || data == NULL) { + ALOGE("isMalFormed size %zu", size); + if (mBuffer != NULL) { + mBuffer->release(); + mBuffer = NULL; + } + return ERROR_MALFORMED; + } + num_bytes_read = mDataSource->readAt(offset, data, size); + if (num_bytes_read < (ssize_t)size) { mBuffer->release(); mBuffer = NULL; - ALOGV("i/o error"); + ALOGE("i/o error"); return ERROR_IO; } @@ -3774,16 +3804,18 @@ status_t MPEG4Source::fragmentedRead( size_t dstOffset = 0; while (srcOffset < size) { - bool isMalFormed = !isInRange(0u, size, srcOffset, mNALLengthSize); + isMalFormed = !isInRange((size_t)0u, size, srcOffset, mNALLengthSize); size_t nalLength = 0; if (!isMalFormed) { nalLength = parseNALSize(&mSrcBuffer[srcOffset]); srcOffset += mNALLengthSize; - isMalFormed = !isInRange(0u, size, srcOffset, nalLength); + isMalFormed = !isInRange((size_t)0u, size, srcOffset, nalLength) + || !isInRange((size_t)0u, mBuffer->size(), dstOffset, (size_t)4u) + || !isInRange((size_t)0u, mBuffer->size(), dstOffset + 4, nalLength); } if (isMalFormed) { - ALOGE("Video is malformed"); + ALOGE("Video is malformed; nalLength %zu", nalLength); mBuffer->release(); mBuffer = NULL; return ERROR_MALFORMED; |