diff options
Diffstat (limited to 'media/libstagefright/MPEG4Extractor.cpp')
-rw-r--r-- | media/libstagefright/MPEG4Extractor.cpp | 20 |
1 files changed, 19 insertions, 1 deletions
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index 8e6840d..e009a0e 100644 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -44,6 +44,10 @@ #include <byteswap.h> #include "include/ID3.h" +#ifndef UINT32_MAX +#define UINT32_MAX (4294967295U) +#endif + namespace android { class MPEG4Source : public MediaSource { @@ -3325,13 +3329,27 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets( return ERROR_IO; } offset += 4; + if (entrycount == 0) { + return OK; + } + if (entrycount > UINT32_MAX / 8) { + return ERROR_MALFORMED; + } if (entrycount > mCurrentSampleInfoOffsetsAllocSize) { - mCurrentSampleInfoOffsets = (uint64_t*) realloc(mCurrentSampleInfoOffsets, entrycount * 8); + uint64_t *newPtr = (uint64_t *)realloc(mCurrentSampleInfoOffsets, entrycount * 8); + if (newPtr == NULL) { + return NO_MEMORY; + } + mCurrentSampleInfoOffsets = newPtr; mCurrentSampleInfoOffsetsAllocSize = entrycount; } mCurrentSampleInfoOffsetCount = entrycount; + if (mCurrentSampleInfoOffsets == NULL) { + return OK; + } + for (size_t i = 0; i < entrycount; i++) { if (version == 0) { uint32_t tmp; |