From 3564c4562f46bede6ef1ea716c4fd4f77e470ae8 Mon Sep 17 00:00:00 2001 From: Wei Jia Date: Tue, 18 Aug 2015 11:17:24 -0700 Subject: libstagefright: fix handling of mSampleTimeEntries and mNumSampleSizes in SampleTable. Bug: 23247055 Change-Id: I29ef59c7ff09248063714e5013f7c33f66c5eebd --- media/libstagefright/SampleTable.cpp | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) (limited to 'media/libstagefright/SampleTable.cpp') diff --git a/media/libstagefright/SampleTable.cpp b/media/libstagefright/SampleTable.cpp index aeef99f..97dff43 100644 --- a/media/libstagefright/SampleTable.cpp +++ b/media/libstagefright/SampleTable.cpp @@ -27,6 +27,11 @@ #include #include +/* TODO: remove after being merged into other branches */ +#ifndef UINT32_MAX +#define UINT32_MAX (4294967295U) +#endif + namespace android { // static @@ -284,6 +289,9 @@ status_t SampleTable::setSampleSizeParams( mDefaultSampleSize = U32_AT(&header[4]); mNumSampleSizes = U32_AT(&header[8]); + if (mNumSampleSizes > (UINT32_MAX - 12) / 16) { + return ERROR_MALFORMED; + } if (type == kSampleSizeType32) { mSampleSizeFieldSize = 32; @@ -507,7 +515,7 @@ int SampleTable::CompareIncreasingTime(const void *_a, const void *_b) { void SampleTable::buildSampleEntriesTable() { Mutex::Autolock autoLock(mLock); - if (mSampleTimeEntries != NULL) { + if (mSampleTimeEntries != NULL || mNumSampleSizes == 0) { return; } @@ -552,6 +560,10 @@ status_t SampleTable::findSampleAtTime( uint32_t *sample_index, uint32_t flags) { buildSampleEntriesTable(); + if (mSampleTimeEntries == NULL) { + return ERROR_OUT_OF_RANGE; + } + uint32_t left = 0; uint32_t right_plus_one = mNumSampleSizes; while (left < right_plus_one) { -- cgit v1.1