diff options
author | Wei Jia <wjia@google.com> | 2015-10-06 16:45:37 +0000 |
---|---|---|
committer | Android Git Automerger <android-git-automerger@android.com> | 2015-10-06 16:45:37 +0000 |
commit | 62d89908f6c7e3da9dac36aa439ceb1c2522b86d (patch) | |
tree | fd11434b45bb4a86987ed3eb0c979c20b70649c0 /media | |
parent | 7ce825833ad65cebfded3f35457925ae9e00124a (diff) | |
parent | df68d9d5bf5329bc2f7effb6afa1d3904eaf30d8 (diff) | |
download | frameworks_av-62d89908f6c7e3da9dac36aa439ceb1c2522b86d.zip frameworks_av-62d89908f6c7e3da9dac36aa439ceb1c2522b86d.tar.gz frameworks_av-62d89908f6c7e3da9dac36aa439ceb1c2522b86d.tar.bz2 |
am df68d9d5: am 60b25aa0: am 9ab9c85e: Merge "MPEG4Extractor: ensure buffer size is not less than 8 for LastCommentData." into klp-dev
* commit 'df68d9d5bf5329bc2f7effb6afa1d3904eaf30d8':
MPEG4Extractor: ensure buffer size is not less than 8 for LastCommentData.
Diffstat (limited to 'media')
-rw-r--r-- | media/libstagefright/MPEG4Extractor.cpp | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index e09ecc2..d9975bb 100644 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -2347,6 +2347,12 @@ status_t MPEG4Extractor::parseITunesMetaData(off64_t offset, size_t size) { mLastCommentName.setTo((const char *)buffer + 4); break; case FOURCC('d', 'a', 't', 'a'): + if (size < 8) { + delete[] buffer; + buffer = NULL; + ALOGE("b/24346430"); + return ERROR_MALFORMED; + } mLastCommentData.setTo((const char *)buffer + 8); break; } |