am 92aa28ad: am a7516e90: Merge "Make sure the .wav extractor does not read data outside the bounds of the \'data\' box." into gingerbread

Merge commit '92aa28addd5dbe576b2c1b66cbc00c561402f2b9'

* commit '92aa28addd5dbe576b2c1b66cbc00c561402f2b9':
  Make sure the .wav extractor does not read data outside the bounds of the 'data' box.

1 files changed, 12 insertions, 1 deletions

diff --git a/media/libstagefright/WAVExtractor.cpp b/media/libstagefright/WAVExtractor.cpp
index 57c1075..aff06bc 100644
--- a/media/libstagefright/WAVExtractor.cpp
+++ b/media/libstagefright/WAVExtractor.cpp
@@ -331,9 +331,20 @@ status_t WAVSource::read(
         return err;
     }
 
+    size_t maxBytesToRead =
+        mBitsPerSample == 8 ? kMaxFrameSize / 2 : kMaxFrameSize;
+
+    size_t maxBytesAvailable =
+        (mCurrentPos - mOffset >= (off_t)mSize)
+            ? 0 : mSize - (mCurrentPos - mOffset);
+
+    if (maxBytesToRead > maxBytesAvailable) {
+        maxBytesToRead = maxBytesAvailable;
+    }
+
     ssize_t n = mDataSource->readAt(
             mCurrentPos, buffer->data(),
-            mBitsPerSample == 8 ? kMaxFrameSize / 2 : kMaxFrameSize);
+            maxBytesToRead);
 
     if (n <= 0) {
         buffer->release();