diff options
author | Wonsik Kim <wonsik@google.com> | 2015-09-02 16:02:19 +0900 |
---|---|---|
committer | Wonsik Kim <wonsik@google.com> | 2015-09-03 10:24:31 +0900 |
commit | 76483691ea93aed0433dee050abfc9fa934c4f62 (patch) | |
tree | 5d70b137a5e2388149920772ffc6c167e6b092c9 /media/libstagefright/OggExtractor.cpp | |
parent | 389e765394a950b9697bba49c1998f2029bd58b4 (diff) | |
download | frameworks_av-76483691ea93aed0433dee050abfc9fa934c4f62.zip frameworks_av-76483691ea93aed0433dee050abfc9fa934c4f62.tar.gz frameworks_av-76483691ea93aed0433dee050abfc9fa934c4f62.tar.bz2 |
Ogg: avoid size_t overflow in base64 decoding
Bug: 23707088
Change-Id: I8d32841fee3213c721cdcc57788807ea64d19d74
Diffstat (limited to 'media/libstagefright/OggExtractor.cpp')
-rw-r--r-- | media/libstagefright/OggExtractor.cpp | 20 |
1 files changed, 15 insertions, 5 deletions
diff --git a/media/libstagefright/OggExtractor.cpp b/media/libstagefright/OggExtractor.cpp index 6fba8e1..d5c929e 100644 --- a/media/libstagefright/OggExtractor.cpp +++ b/media/libstagefright/OggExtractor.cpp @@ -1220,11 +1220,14 @@ static uint8_t *DecodeBase64(const char *s, size_t size, size_t *outSize) { } } - size_t outLen = 3 * size / 4 - padding; - - *outSize = outLen; + // We divide first to avoid overflow. It's OK to do this because we + // already made sure that size % 4 == 0. + size_t outLen = (size / 4) * 3 - padding; void *buffer = malloc(outLen); + if (buffer == NULL) { + return NULL; + } uint8_t *out = (uint8_t *)buffer; size_t j = 0; @@ -1243,10 +1246,10 @@ static uint8_t *DecodeBase64(const char *s, size_t size, size_t *outSize) { } else if (c == '/') { value = 63; } else if (c != '=') { - return NULL; + break; } else { if (i < n - padding) { - return NULL; + break; } value = 0; @@ -1264,6 +1267,13 @@ static uint8_t *DecodeBase64(const char *s, size_t size, size_t *outSize) { } } + // Check if we exited the loop early. + if (j < outLen) { + free(buffer); + return NULL; + } + + *outSize = outLen; return (uint8_t *)buffer; } |