diff options
author | Jessica Wagantall <jwagantall@cyngn.com> | 2016-06-07 10:19:42 -0700 |
---|---|---|
committer | Jessica Wagantall <jwagantall@cyngn.com> | 2016-06-07 10:19:42 -0700 |
commit | 80c362fec14af5f22e6d3967fc4ea04b363084da (patch) | |
tree | fe282db5799ca31479a92451d5f297f80d9529d1 /media/libstagefright/SampleTable.cpp | |
parent | 8f270dc1ec91d3b34d62202463e0b03939900449 (diff) | |
parent | b57b3967b1a42dd505dbe4fcf1e1d810e3ae3777 (diff) | |
download | frameworks_av-80c362fec14af5f22e6d3967fc4ea04b363084da.zip frameworks_av-80c362fec14af5f22e6d3967fc4ea04b363084da.tar.gz frameworks_av-80c362fec14af5f22e6d3967fc4ea04b363084da.tar.bz2 |
Merge tag 'android-6.0.1_r46' into HEAD
Android 6.0.1 release 46
Change-Id: I4fcabf5775aebd2cb8dc0e352d1b1460d3214573
Diffstat (limited to 'media/libstagefright/SampleTable.cpp')
-rw-r--r-- | media/libstagefright/SampleTable.cpp | 38 |
1 files changed, 22 insertions, 16 deletions
diff --git a/media/libstagefright/SampleTable.cpp b/media/libstagefright/SampleTable.cpp index 2f69fd8..7d8d184 100644 --- a/media/libstagefright/SampleTable.cpp +++ b/media/libstagefright/SampleTable.cpp @@ -121,8 +121,9 @@ SampleTable::SampleTable(const sp<DataSource> &source) mSampleSizeFieldSize(0), mDefaultSampleSize(0), mNumSampleSizes(0), + mHasTimeToSample(false), mTimeToSampleCount(0), - mTimeToSample(NULL), + mTimeToSample(), mSampleTimeEntries(NULL), mCompositionTimeDeltaEntries(NULL), mNumCompositionTimeDeltaEntries(0), @@ -151,9 +152,6 @@ SampleTable::~SampleTable() { delete[] mSampleTimeEntries; mSampleTimeEntries = NULL; - delete[] mTimeToSample; - mTimeToSample = NULL; - delete mSampleIterator; mSampleIterator = NULL; } @@ -162,7 +160,7 @@ bool SampleTable::isValid() const { return mChunkOffsetOffset >= 0 && mSampleToChunkOffset >= 0 && mSampleSizeOffset >= 0 - && mTimeToSample != NULL; + && mHasTimeToSample; } status_t SampleTable::setChunkOffsetParams( @@ -337,7 +335,7 @@ status_t SampleTable::setSampleSizeParams( status_t SampleTable::setTimeToSampleParams( off64_t data_offset, size_t data_size) { - if (mTimeToSample != NULL || data_size < 8) { + if (mHasTimeToSample || data_size < 8) { return ERROR_MALFORMED; } @@ -353,24 +351,32 @@ status_t SampleTable::setTimeToSampleParams( } mTimeToSampleCount = U32_AT(&header[4]); - uint64_t allocSize = (uint64_t)mTimeToSampleCount * 2 * sizeof(uint32_t); - if (allocSize > UINT32_MAX) { + if ((uint64_t)mTimeToSampleCount > + (uint64_t)UINT32_MAX / (2 * sizeof(uint32_t))) { + // Choose this bound because + // 1) 2 * sizeof(uint32_t) is the amount of memory needed for one + // time-to-sample entry in the time-to-sample table. + // 2) mTimeToSampleCount is the number of entries of the time-to-sample + // table. + // 3) We hope that the table size does not exceed UINT32_MAX. + ALOGE(" Error: Time-to-sample table size too large."); + return ERROR_OUT_OF_RANGE; } - mTimeToSample = new (std::nothrow) uint32_t[mTimeToSampleCount * 2]; - if (!mTimeToSample) - return ERROR_OUT_OF_RANGE; - size_t size = sizeof(uint32_t) * mTimeToSampleCount * 2; - if (mDataSource->readAt( - data_offset + 8, mTimeToSample, size) < (ssize_t)size) { + // Note: At this point, we know that mTimeToSampleCount * 2 will not + // overflow because of the above condition. + if (!mDataSource->getVector(data_offset + 8, &mTimeToSample, + mTimeToSampleCount * 2)) { + ALOGE(" Error: Incomplete data read for time-to-sample table."); return ERROR_IO; } - for (uint32_t i = 0; i < mTimeToSampleCount * 2; ++i) { - mTimeToSample[i] = ntohl(mTimeToSample[i]); + for (size_t i = 0; i < mTimeToSample.size(); ++i) { + mTimeToSample.editItemAt(i) = ntohl(mTimeToSample[i]); } + mHasTimeToSample = true; return OK; } |