summaryrefslogtreecommitdiffstats
path: root/media
diff options
context:
space:
mode:
authorRobert Shih <robertshih@google.com>2015-08-22 01:08:44 +0000
committerAndroid Git Automerger <android-git-automerger@android.com>2015-08-22 01:08:44 +0000
commiteecc406f462ef2b3a73cd6bf3c05f7cb45382276 (patch)
treeb2a5d72348212afbe32b9ee8a15ae34bbe1dfddb /media
parentf814f84e09191af23bbf8d307f02704e20cc887c (diff)
parent3b42241aab5855964d1bd60268ae21c2d9cc6065 (diff)
downloadframeworks_av-eecc406f462ef2b3a73cd6bf3c05f7cb45382276.zip
frameworks_av-eecc406f462ef2b3a73cd6bf3c05f7cb45382276.tar.gz
frameworks_av-eecc406f462ef2b3a73cd6bf3c05f7cb45382276.tar.bz2
am 3b42241a: Merge "Prevent integer issues in ID3::Iterator::findFrame" into klp-dev
* commit '3b42241aab5855964d1bd60268ae21c2d9cc6065': Prevent integer issues in ID3::Iterator::findFrame
Diffstat (limited to 'media')
-rw-r--r--media/libstagefright/id3/ID3.cpp23
1 files changed, 21 insertions, 2 deletions
diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp
index 8dcecbb..f2a8a73 100644
--- a/media/libstagefright/id3/ID3.cpp
+++ b/media/libstagefright/id3/ID3.cpp
@@ -659,6 +659,11 @@ void ID3::Iterator::findFrame() {
mFrameSize += 6;
+ // Prevent integer overflow in validation
+ if (SIZE_MAX - mOffset <= mFrameSize) {
+ return;
+ }
+
if (mOffset + mFrameSize > mParent.mSize) {
ALOGV("partial frame at offset %d (size = %d, bytes-remaining = %d)",
mOffset, mFrameSize, mParent.mSize - mOffset - 6);
@@ -688,7 +693,7 @@ void ID3::Iterator::findFrame() {
return;
}
- size_t baseSize;
+ size_t baseSize = 0;
if (mParent.mVersion == ID3_V2_4) {
if (!ParseSyncsafeInteger(
&mParent.mData[mOffset + 4], &baseSize)) {
@@ -698,7 +703,21 @@ void ID3::Iterator::findFrame() {
baseSize = U32_AT(&mParent.mData[mOffset + 4]);
}
- mFrameSize = 10 + baseSize;
+ if (baseSize == 0) {
+ return;
+ }
+
+ // Prevent integer overflow when adding
+ if (SIZE_MAX - 10 <= baseSize) {
+ return;
+ }
+
+ mFrameSize = 10 + baseSize; // add tag id, size field and flags
+
+ // Prevent integer overflow in validation
+ if (SIZE_MAX - mOffset <= mFrameSize) {
+ return;
+ }
if (mOffset + mFrameSize > mParent.mSize) {
ALOGV("partial frame at offset %d (size = %d, bytes-remaining = %d)",