From 28f82bc8d580a1e7ab2814cd0f75b47d42b2066c Mon Sep 17 00:00:00 2001 From: "Joshua J. Drake" Date: Mon, 4 May 2015 17:14:11 -0500 Subject: Fix integer underflow in covr MPEG4 processing When the 'chunk_data_size' variable is less than 'kSkipBytesOfDataBox', an integer underflow can occur. This causes an extraordinarily large value to be passed to MetaData::setData, leading to a buffer overflow. Bug: 20923261 Change-Id: Icd28f63594ad941eabb3a12c750a4a2d5d2bf94b Signed-off-by: Joshua J. Drake Tested-by: Moritz Bandemer --- media/libstagefright/MPEG4Extractor.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index ae592c4..28c41c4 100644 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -1550,6 +1550,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { return ERROR_IO; } const int kSkipBytesOfDataBox = 16; + if (chunk_data_size <= kSkipBytesOfDataBox) { + return ERROR_MALFORMED; + } + mFileMetaData->setData( kKeyAlbumArt, MetaData::TYPE_NONE, buffer + kSkipBytesOfDataBox, chunk_data_size - kSkipBytesOfDataBox); -- cgit v1.1