diff options
| author | Abhishek Arya <aarya@google.com> | 2015-08-18 13:28:34 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2015-08-18 13:28:34 +0000 |
| commit | 6efa86beff54332cbf7bbd4949b0c38c1ec8c5cd (patch) | |
| tree | c28630e1e229a01959f929c56894695525ff988d /media | |
| parent | 6f561b93d8c6473fa0baa281ad4a53f882e656cc (diff) | |
| parent | 073e4f6748f5d7deb095c42fad9271cb99e22d07 (diff) | |
| download | frameworks_av-6efa86beff54332cbf7bbd4949b0c38c1ec8c5cd.zip frameworks_av-6efa86beff54332cbf7bbd4949b0c38c1ec8c5cd.tar.gz frameworks_av-6efa86beff54332cbf7bbd4949b0c38c1ec8c5cd.tar.bz2 | |
Merge "Check vector size before accessing" into klp-dev
Diffstat (limited to 'media')
| -rw-r--r-- | media/libstagefright/MPEG4Extractor.cpp | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index 9f257f7..6e74a8f 100644 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -2747,8 +2747,17 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets(off64_t offset, off int ivlength; CHECK(mFormat->findInt32(kKeyCryptoDefaultIVSize, &ivlength)); + // only 0, 8 and 16 byte initialization vectors are supported + if (ivlength != 0 && ivlength != 8 && ivlength != 16) { + ALOGW("unsupported IV length: %d", ivlength); + return ERROR_MALFORMED; + } // read CencSampleAuxiliaryDataFormats for (size_t i = 0; i < mCurrentSampleInfoCount; i++) { + if (i >= mCurrentSamples.size()) { + ALOGW("too few samples"); + break; + } Sample *smpl = &mCurrentSamples.editItemAt(i); memset(smpl->iv, 0, 16); |