summaryrefslogtreecommitdiffstats
path: root/media
diff options
context:
space:
mode:
authorMarco Nelissen <marcone@google.com>2016-01-12 23:14:53 +0000
committerandroid-build-merger <android-build-merger@google.com>2016-01-12 23:14:53 +0000
commit827e12087d583d76e4caec3090df9aea7b7a4e01 (patch)
tree3658dcdd789bbf18447719f5a2f081a872647331 /media
parentf27fc04067adfee74b90323c5219ff30f886d8d1 (diff)
parent0dd00d9b1986cd2cc4f45bdb96266dee01f20d72 (diff)
downloadframeworks_av-827e12087d583d76e4caec3090df9aea7b7a4e01.zip
frameworks_av-827e12087d583d76e4caec3090df9aea7b7a4e01.tar.gz
frameworks_av-827e12087d583d76e4caec3090df9aea7b7a4e01.tar.bz2
Fix out-of-bounds write am: 5403587a74 am: fb2eb86102 am: e6bd186c7e am: a8ac8f617b am: e2e46f5fa1 am: 2304c606eb am: 0945199000 am: a39f981875 am: e463301aa4
am: 0dd00d9b19 * commit '0dd00d9b1986cd2cc4f45bdb96266dee01f20d72': Fix out-of-bounds write
Diffstat (limited to 'media')
-rwxr-xr-xmedia/libstagefright/MPEG4Extractor.cpp10
1 files changed, 9 insertions, 1 deletions
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index bfdff38..e4f8384 100755
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -4545,7 +4545,15 @@ status_t MPEG4Source::fragmentedRead(
continue;
}
- CHECK(dstOffset + 4 <= mBuffer->size());
+ if (dstOffset > SIZE_MAX - 4 ||
+ dstOffset + 4 > SIZE_MAX - nalLength ||
+ dstOffset + 4 + nalLength > mBuffer->size()) {
+ ALOGE("b/26365349 : %zu %zu", dstOffset, mBuffer->size());
+ android_errorWriteLog(0x534e4554, "26365349");
+ mBuffer->release();
+ mBuffer = NULL;
+ return ERROR_MALFORMED;
+ }
dstData[dstOffset++] = 0;
dstData[dstOffset++] = 0;