diff options
| author | Wei Jia <wjia@google.com> | 2015-08-20 17:04:07 +0000 |
|---|---|---|
| committer | Android Git Automerger <android-git-automerger@android.com> | 2015-08-20 17:04:07 +0000 |
| commit | d7c205fe1f7cda2cdcb3062b548c0777402bab38 (patch) | |
| tree | 7c2af71957bb9d7bd6f2c6131ef6144850db5f8c /media | |
| parent | cb2acbfed69d18aa4693c03d8a77cd45daf8af8d (diff) | |
| parent | 522019f15b3c191b73d1a0ddb56aeb3dd6b7ce31 (diff) | |
| download | frameworks_av-d7c205fe1f7cda2cdcb3062b548c0777402bab38.zip frameworks_av-d7c205fe1f7cda2cdcb3062b548c0777402bab38.tar.gz frameworks_av-d7c205fe1f7cda2cdcb3062b548c0777402bab38.tar.bz2 | |
am 522019f1: Merge "libstagefright: fix handling of mSampleTimeEntries and mNumSampleSizes in SampleTable." into klp-dev
* commit '522019f15b3c191b73d1a0ddb56aeb3dd6b7ce31':
libstagefright: fix handling of mSampleTimeEntries and mNumSampleSizes in SampleTable.
Diffstat (limited to 'media')
| -rw-r--r-- | media/libstagefright/SampleTable.cpp | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/media/libstagefright/SampleTable.cpp b/media/libstagefright/SampleTable.cpp index 52ce82b..116f358 100644 --- a/media/libstagefright/SampleTable.cpp +++ b/media/libstagefright/SampleTable.cpp @@ -27,6 +27,11 @@ #include <media/stagefright/DataSource.h> #include <media/stagefright/Utils.h> +/* TODO: remove after being merged into other branches */ +#ifndef UINT32_MAX +#define UINT32_MAX (4294967295U) +#endif + namespace android { // static @@ -282,6 +287,9 @@ status_t SampleTable::setSampleSizeParams( mDefaultSampleSize = U32_AT(&header[4]); mNumSampleSizes = U32_AT(&header[8]); + if (mNumSampleSizes > (UINT32_MAX - 12) / 16) { + return ERROR_MALFORMED; + } if (type == kSampleSizeType32) { mSampleSizeFieldSize = 32; @@ -498,7 +506,7 @@ int SampleTable::CompareIncreasingTime(const void *_a, const void *_b) { void SampleTable::buildSampleEntriesTable() { Mutex::Autolock autoLock(mLock); - if (mSampleTimeEntries != NULL) { + if (mSampleTimeEntries != NULL || mNumSampleSizes == 0) { return; } @@ -540,6 +548,10 @@ status_t SampleTable::findSampleAtTime( uint32_t req_time, uint32_t *sample_index, uint32_t flags) { buildSampleEntriesTable(); + if (mSampleTimeEntries == NULL) { + return ERROR_OUT_OF_RANGE; + } + uint32_t left = 0; uint32_t right = mNumSampleSizes; while (left < right) { |