diff options
author | Wei Jia <wjia@google.com> | 2015-08-20 17:07:14 +0000 |
---|---|---|
committer | Android Git Automerger <android-git-automerger@android.com> | 2015-08-20 17:07:14 +0000 |
commit | f076fabff7a518ed5668a9a1be03dd729b8cbfb6 (patch) | |
tree | d5fefeabf50ee9f7bccfc965f617a75084cbc4ad /media/libstagefright/MPEG4Extractor.cpp | |
parent | 238a487a0cf0fde606a27ea1f00bad5d92589161 (diff) | |
parent | 0af43510cc45373614cdfce7d014283100e96cb9 (diff) | |
download | frameworks_av-f076fabff7a518ed5668a9a1be03dd729b8cbfb6.zip frameworks_av-f076fabff7a518ed5668a9a1be03dd729b8cbfb6.tar.gz frameworks_av-f076fabff7a518ed5668a9a1be03dd729b8cbfb6.tar.bz2 |
am 0af43510: am 2562495d: am a590baca: Merge commit \'6ae815e0\' into HEAD
* commit '0af43510cc45373614cdfce7d014283100e96cb9':
libstagefright: fix overflow in MPEG4Source::parseSampleAuxiliaryInformationOffsets.
Diffstat (limited to 'media/libstagefright/MPEG4Extractor.cpp')
-rw-r--r-- | media/libstagefright/MPEG4Extractor.cpp | 20 |
1 files changed, 19 insertions, 1 deletions
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index 8e6840d..e009a0e 100644 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -44,6 +44,10 @@ #include <byteswap.h> #include "include/ID3.h" +#ifndef UINT32_MAX +#define UINT32_MAX (4294967295U) +#endif + namespace android { class MPEG4Source : public MediaSource { @@ -3325,13 +3329,27 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets( return ERROR_IO; } offset += 4; + if (entrycount == 0) { + return OK; + } + if (entrycount > UINT32_MAX / 8) { + return ERROR_MALFORMED; + } if (entrycount > mCurrentSampleInfoOffsetsAllocSize) { - mCurrentSampleInfoOffsets = (uint64_t*) realloc(mCurrentSampleInfoOffsets, entrycount * 8); + uint64_t *newPtr = (uint64_t *)realloc(mCurrentSampleInfoOffsets, entrycount * 8); + if (newPtr == NULL) { + return NO_MEMORY; + } + mCurrentSampleInfoOffsets = newPtr; mCurrentSampleInfoOffsetsAllocSize = entrycount; } mCurrentSampleInfoOffsetCount = entrycount; + if (mCurrentSampleInfoOffsets == NULL) { + return OK; + } + for (size_t i = 0; i < entrycount; i++) { if (version == 0) { uint32_t tmp; |