diff options
author | Joshua J. Drake <android-open-source@qoop.org> | 2015-04-08 23:31:25 -0500 |
---|---|---|
committer | Nick Kralevich <nnk@google.com> | 2015-04-09 17:34:16 -0700 |
commit | ad435371a4b95e16ceb49ab28efc04da8b3680e1 (patch) | |
tree | ad8b4ad627fcee22ab60f9a711d447dc64759bda /media/libstagefright/SampleTable.cpp | |
parent | e2e812e58e8d2716b00d7d82db99b08d3afb4b32 (diff) | |
download | frameworks_av-ad435371a4b95e16ceb49ab28efc04da8b3680e1.zip frameworks_av-ad435371a4b95e16ceb49ab28efc04da8b3680e1.tar.gz frameworks_av-ad435371a4b95e16ceb49ab28efc04da8b3680e1.tar.bz2 |
Detect allocation failures and bail gracefully
During the processing of several sample table related MP4 atoms, allocation
sizes could be large enough cause a std::bad_alloc exception to be raised. This
typically causes a crash (denial of service condition). Use std::nothrow to
catch allocation failures and return gracefully.
Bug: 20139950
Change-Id: I03d3f01b24e5fe3fa38985914bcfa694ea3dc09e
Diffstat (limited to 'media/libstagefright/SampleTable.cpp')
-rw-r--r-- | media/libstagefright/SampleTable.cpp | 21 |
1 files changed, 16 insertions, 5 deletions
diff --git a/media/libstagefright/SampleTable.cpp b/media/libstagefright/SampleTable.cpp index b572af3..bfae474 100644 --- a/media/libstagefright/SampleTable.cpp +++ b/media/libstagefright/SampleTable.cpp @@ -231,7 +231,9 @@ status_t SampleTable::setSampleToChunkParams( } mSampleToChunkEntries = - new SampleToChunkEntry[mNumSampleToChunkOffsets]; + new (std::nothrow) SampleToChunkEntry[mNumSampleToChunkOffsets]; + if (!mSampleToChunkEntries) + return ERROR_OUT_OF_RANGE; for (uint32_t i = 0; i < mNumSampleToChunkOffsets; ++i) { uint8_t buffer[12]; @@ -334,7 +336,9 @@ status_t SampleTable::setTimeToSampleParams( if (allocSize > SIZE_MAX) { return ERROR_OUT_OF_RANGE; } - mTimeToSample = new uint32_t[mTimeToSampleCount * 2]; + mTimeToSample = new (std::nothrow) uint32_t[mTimeToSampleCount * 2]; + if (!mTimeToSample) + return ERROR_OUT_OF_RANGE; size_t size = sizeof(uint32_t) * mTimeToSampleCount * 2; if (mDataSource->readAt( @@ -381,7 +385,9 @@ status_t SampleTable::setCompositionTimeToSampleParams( return ERROR_OUT_OF_RANGE; } - mCompositionTimeDeltaEntries = new uint32_t[2 * numEntries]; + mCompositionTimeDeltaEntries = new (std::nothrow) uint32_t[2 * numEntries]; + if (!mCompositionTimeDeltaEntries) + return ERROR_OUT_OF_RANGE; if (mDataSource->readAt( data_offset + 8, mCompositionTimeDeltaEntries, numEntries * 8) @@ -431,7 +437,10 @@ status_t SampleTable::setSyncSampleParams(off64_t data_offset, size_t data_size) return ERROR_OUT_OF_RANGE; } - mSyncSamples = new uint32_t[mNumSyncSamples]; + mSyncSamples = new (std::nothrow) uint32_t[mNumSyncSamples]; + if (!mSyncSamples) + return ERROR_OUT_OF_RANGE; + size_t size = mNumSyncSamples * sizeof(uint32_t); if (mDataSource->readAt(mSyncSampleOffset + 8, mSyncSamples, size) != (ssize_t)size) { @@ -499,7 +508,9 @@ void SampleTable::buildSampleEntriesTable() { return; } - mSampleTimeEntries = new SampleTimeEntry[mNumSampleSizes]; + mSampleTimeEntries = new (std::nothrow) SampleTimeEntry[mNumSampleSizes]; + if (!mSampleTimeEntries) + return; uint32_t sampleIndex = 0; uint32_t sampleTime = 0; |