diff options
| author | Joshua J. Drake <android-open-source@qoop.org> | 2015-06-05 16:25:37 +0000 |
|---|---|---|
| committer | Android Git Automerger <android-git-automerger@android.com> | 2015-06-05 16:25:37 +0000 |
| commit | f02c5c9e4e13a493adcf39d0cba2a549d8caa4de (patch) | |
| tree | 3de500ec63065f7ed29c8e06b2a66f00aab3af7b /media | |
| parent | e5ca9a209af40000ad41c461ae1178f479e01a62 (diff) | |
| parent | 4d8ed149894eff1e21195a29d939f2ec389fe5d7 (diff) | |
| download | frameworks_av-f02c5c9e4e13a493adcf39d0cba2a549d8caa4de.zip frameworks_av-f02c5c9e4e13a493adcf39d0cba2a549d8caa4de.tar.gz frameworks_av-f02c5c9e4e13a493adcf39d0cba2a549d8caa4de.tar.bz2 | |
am 4d8ed149: Prevent integer underflow if size is below 6
* commit '4d8ed149894eff1e21195a29d939f2ec389fe5d7':
Prevent integer underflow if size is below 6
Diffstat (limited to 'media')
| -rw-r--r-- | media/libstagefright/MPEG4Extractor.cpp | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index 080dcd1..e74d9a6 100644 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -2468,6 +2468,10 @@ status_t MPEG4Extractor::parse3GPPMetaData(off64_t offset, size_t size, int dept int len16 = 0; // Number of UTF-16 characters // smallest possible valid UTF-16 string w BOM: 0xfe 0xff 0x00 0x00 + if (size < 6) { + return ERROR_MALFORMED; + } + if (size - 6 >= 4) { len16 = ((size - 6) / 2) - 1; // don't include 0x0000 terminator framedata = (char16_t *)(buffer + 6); |