diff options
author | Wei Jia <wjia@google.com> | 2015-08-20 09:42:08 -0700 |
---|---|---|
committer | Wei Jia <wjia@google.com> | 2015-08-20 09:42:08 -0700 |
commit | a590baca031199327f6382347625dd232de2c95c (patch) | |
tree | 40c192b35abb2006e02b514fbb5a19fafc3370cd /media/libstagefright/MPEG4Extractor.cpp | |
parent | 5221133bfa1585b4488b01cad165627b1cd17077 (diff) | |
parent | 6ae815e04f618207da9ce52e3c828492c33a7107 (diff) | |
download | frameworks_av-a590baca031199327f6382347625dd232de2c95c.zip frameworks_av-a590baca031199327f6382347625dd232de2c95c.tar.gz frameworks_av-a590baca031199327f6382347625dd232de2c95c.tar.bz2 |
Merge commit '6ae815e0' into HEAD
libstagefright: fix overflow in MPEG4Source::parseSampleAuxiliaryInformationOffsets.
Bug: 23270724
(cherry picked from commit c51ab7dd82bf4e24666fc72a55e03e2f530204d5)
Change-Id: I44c642548ee6ba3745fb1f46d8645bece231035a
Diffstat (limited to 'media/libstagefright/MPEG4Extractor.cpp')
-rw-r--r-- | media/libstagefright/MPEG4Extractor.cpp | 20 |
1 files changed, 19 insertions, 1 deletions
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index 99b08bf..d306acb 100644 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -42,6 +42,10 @@ #include <byteswap.h> #include "include/ID3.h" +#ifndef UINT32_MAX +#define UINT32_MAX (4294967295U) +#endif + namespace android { class MPEG4Source : public MediaSource { @@ -2911,13 +2915,27 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets(off64_t offset, off return ERROR_IO; } offset += 4; + if (entrycount == 0) { + return OK; + } + if (entrycount > UINT32_MAX / 8) { + return ERROR_MALFORMED; + } if (entrycount > mCurrentSampleInfoOffsetsAllocSize) { - mCurrentSampleInfoOffsets = (uint64_t*) realloc(mCurrentSampleInfoOffsets, entrycount * 8); + uint64_t *newPtr = (uint64_t *)realloc(mCurrentSampleInfoOffsets, entrycount * 8); + if (newPtr == NULL) { + return NO_MEMORY; + } + mCurrentSampleInfoOffsets = newPtr; mCurrentSampleInfoOffsetsAllocSize = entrycount; } mCurrentSampleInfoOffsetCount = entrycount; + if (mCurrentSampleInfoOffsets == NULL) { + return OK; + } + for (size_t i = 0; i < entrycount; i++) { if (version == 0) { uint32_t tmp; |