diff options
| author | Andreas Huber <andih@google.com> | 2010-09-16 14:54:10 -0700 |
|---|---|---|
| committer | Andreas Huber <andih@google.com> | 2010-09-16 14:54:10 -0700 |
| commit | 104fcb88d4125caff74f63be4ce23537ca693ac7 (patch) | |
| tree | 0511860a87916408b293a0119b17a03c50e3c84b /media/libstagefright/WAVExtractor.cpp | |
| parent | aae3516293e58c0b015d4109bde58c11d503433c (diff) | |
| download | frameworks_av-104fcb88d4125caff74f63be4ce23537ca693ac7.zip frameworks_av-104fcb88d4125caff74f63be4ce23537ca693ac7.tar.gz frameworks_av-104fcb88d4125caff74f63be4ce23537ca693ac7.tar.bz2 | |
Make sure the .wav extractor does not read data outside the bounds of the 'data' box.
Change-Id: Icf18f9224d97e6a78328dd429ebc3a3433e5cecd
related-to-bug: 3007790
Diffstat (limited to 'media/libstagefright/WAVExtractor.cpp')
| -rw-r--r-- | media/libstagefright/WAVExtractor.cpp | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/media/libstagefright/WAVExtractor.cpp b/media/libstagefright/WAVExtractor.cpp index 57c1075..aff06bc 100644 --- a/media/libstagefright/WAVExtractor.cpp +++ b/media/libstagefright/WAVExtractor.cpp @@ -331,9 +331,20 @@ status_t WAVSource::read( return err; } + size_t maxBytesToRead = + mBitsPerSample == 8 ? kMaxFrameSize / 2 : kMaxFrameSize; + + size_t maxBytesAvailable = + (mCurrentPos - mOffset >= (off_t)mSize) + ? 0 : mSize - (mCurrentPos - mOffset); + + if (maxBytesToRead > maxBytesAvailable) { + maxBytesToRead = maxBytesAvailable; + } + ssize_t n = mDataSource->readAt( mCurrentPos, buffer->data(), - mBitsPerSample == 8 ? kMaxFrameSize / 2 : kMaxFrameSize); + maxBytesToRead); if (n <= 0) { buffer->release(); |