diff options
author | Wonsik Kim <wonsik@google.com> | 2015-09-02 16:02:19 +0900 |
---|---|---|
committer | Wonsik Kim <wonsik@google.com> | 2015-09-03 06:15:02 +0000 |
commit | d26052738f7b095b7e318c8dde7f32db0a48450c (patch) | |
tree | 1b405a0f494c813126156bff30de0ebf0d6454c4 /media/libstagefright/OggExtractor.cpp | |
parent | f394f12167fddbc755855d06b615509517c99f14 (diff) | |
download | frameworks_av-d26052738f7b095b7e318c8dde7f32db0a48450c.zip frameworks_av-d26052738f7b095b7e318c8dde7f32db0a48450c.tar.gz frameworks_av-d26052738f7b095b7e318c8dde7f32db0a48450c.tar.bz2 |
Ogg: avoid size_t overflow in base64 decoding
Bug: 23707088
Change-Id: I8d32841fee3213c721cdcc57788807ea64d19d74
Diffstat (limited to 'media/libstagefright/OggExtractor.cpp')
-rw-r--r-- | media/libstagefright/OggExtractor.cpp | 20 |
1 files changed, 15 insertions, 5 deletions
diff --git a/media/libstagefright/OggExtractor.cpp b/media/libstagefright/OggExtractor.cpp index 073c53f..28c9c7c 100644 --- a/media/libstagefright/OggExtractor.cpp +++ b/media/libstagefright/OggExtractor.cpp @@ -844,11 +844,14 @@ static uint8_t *DecodeBase64(const char *s, size_t size, size_t *outSize) { } } - size_t outLen = 3 * size / 4 - padding; - - *outSize = outLen; + // We divide first to avoid overflow. It's OK to do this because we + // already made sure that size % 4 == 0. + size_t outLen = (size / 4) * 3 - padding; void *buffer = malloc(outLen); + if (buffer == NULL) { + return NULL; + } uint8_t *out = (uint8_t *)buffer; size_t j = 0; @@ -867,10 +870,10 @@ static uint8_t *DecodeBase64(const char *s, size_t size, size_t *outSize) { } else if (c == '/') { value = 63; } else if (c != '=') { - return NULL; + break; } else { if (i < n - padding) { - return NULL; + break; } value = 0; @@ -888,6 +891,13 @@ static uint8_t *DecodeBase64(const char *s, size_t size, size_t *outSize) { } } + // Check if we exited the loop early. + if (j < outLen) { + free(buffer); + return NULL; + } + + *outSize = outLen; return (uint8_t *)buffer; } |