diff options
Diffstat (limited to 'media/libstagefright/MPEG4Extractor.cpp')
| -rw-r--r-- | media/libstagefright/MPEG4Extractor.cpp | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index be3bc4a..9689ce4 100644 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -33,6 +33,7 @@ #include <media/stagefright/foundation/ABuffer.h> #include <media/stagefright/foundation/ADebug.h> #include <media/stagefright/foundation/AMessage.h> +#include <media/stagefright/foundation/AUtils.h> #include <media/stagefright/MediaBuffer.h> #include <media/stagefright/MediaBufferGroup.h> #include <media/stagefright/MediaDefs.h> @@ -221,8 +222,7 @@ status_t MPEG4DataSource::initCheck() const { ssize_t MPEG4DataSource::readAt(off64_t offset, void *data, size_t size) { Mutex::Autolock autoLock(mLock); - if (offset >= mCachedOffset - && offset + size <= mCachedOffset + mCachedSize) { + if (isInRange(mCachedOffset, mCachedSize, offset, size)) { memcpy(data, &mCache[offset - mCachedOffset], size); return size; } @@ -3882,12 +3882,12 @@ status_t MPEG4Source::read( size_t dstOffset = 0; while (srcOffset < size) { - bool isMalFormed = (srcOffset + mNALLengthSize > size); + bool isMalFormed = !isInRange((size_t)0u, size, srcOffset, mNALLengthSize); size_t nalLength = 0; if (!isMalFormed) { nalLength = parseNALSize(&mSrcBuffer[srcOffset]); srcOffset += mNALLengthSize; - isMalFormed = srcOffset + nalLength > size; + isMalFormed = !isInRange((size_t)0u, size, srcOffset, nalLength); } if (isMalFormed) { @@ -4159,12 +4159,12 @@ status_t MPEG4Source::fragmentedRead( size_t dstOffset = 0; while (srcOffset < size) { - bool isMalFormed = (srcOffset + mNALLengthSize > size); + bool isMalFormed = !isInRange((size_t)0u, size, srcOffset, mNALLengthSize); size_t nalLength = 0; if (!isMalFormed) { nalLength = parseNALSize(&mSrcBuffer[srcOffset]); srcOffset += mNALLengthSize; - isMalFormed = srcOffset + nalLength > size; + isMalFormed = !isInRange((size_t)0u, size, srcOffset, nalLength); } if (isMalFormed) { |