From 4e35e8fa2a6c3d06a1de0add38ee8e994fcf2d42 Mon Sep 17 00:00:00 2001 From: "Joshua J. Drake" Date: Sat, 15 Aug 2015 07:43:39 -0500 Subject: Prevent divide by zero in WAVExtractor In the case that mNumChannels, bytesPerSample, or mSampleRate are zero, a divide by zero occurs. None of these parameters of a WAV file should ever be zero. Check that they aren't and return an error otherwise. Bug: 23285883 Change-Id: Id67b8620944405ca59572221f6f1c2b19c363e69 --- media/libstagefright/WAVExtractor.cpp | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'media/libstagefright/WAVExtractor.cpp') diff --git a/media/libstagefright/WAVExtractor.cpp b/media/libstagefright/WAVExtractor.cpp index cc1d7ce..62bb416 100644 --- a/media/libstagefright/WAVExtractor.cpp +++ b/media/libstagefright/WAVExtractor.cpp @@ -315,9 +315,17 @@ status_t WAVExtractor::init() { 1000000LL * (mDataSize / 65 * 320) / 8000; } else { size_t bytesPerSample = mBitsPerSample >> 3; + + if (!bytesPerSample || !mNumChannels) + return ERROR_MALFORMED; + + size_t num_samples = mDataSize / (mNumChannels * bytesPerSample); + + if (!mSampleRate) + return ERROR_MALFORMED; + durationUs = - 1000000LL * (mDataSize / (mNumChannels * bytesPerSample)) - / mSampleRate; + 1000000LL * num_samples / mSampleRate; } mTrackMeta->setInt64(kKeyDuration, durationUs); -- cgit v1.1