From 74814b70482b3b9eb7f5d979b1d8f76a6eb56667 Mon Sep 17 00:00:00 2001 From: Wonsik Kim Date: Mon, 7 Sep 2015 15:52:27 +0900 Subject: DO NOT MERGE Avoid size_t overflow in base64 decoding once again Switch to foundation base64 function in OggExtractor and fix the issue there. Bug: 23707088 Change-Id: If8ba3347c213fe7a36668c943ed264f2871ad468 --- media/libstagefright/foundation/base64.cpp | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) (limited to 'media/libstagefright/foundation') diff --git a/media/libstagefright/foundation/base64.cpp b/media/libstagefright/foundation/base64.cpp index dcf5bef..7da7db9 100644 --- a/media/libstagefright/foundation/base64.cpp +++ b/media/libstagefright/foundation/base64.cpp @@ -22,11 +22,11 @@ namespace android { sp decodeBase64(const AString &s) { - if ((s.size() % 4) != 0) { + size_t n = s.size(); + if ((n % 4) != 0) { return NULL; } - size_t n = s.size(); size_t padding = 0; if (n >= 1 && s.c_str()[n - 1] == '=') { padding = 1; @@ -40,11 +40,16 @@ sp decodeBase64(const AString &s) { } } - size_t outLen = 3 * s.size() / 4 - padding; + // We divide first to avoid overflow. It's OK to do this because we + // already made sure that n % 4 == 0. + size_t outLen = (n / 4) * 3 - padding; sp buffer = new ABuffer(outLen); uint8_t *out = buffer->data(); + if (out == NULL || buffer->size() < outLen) { + return NULL; + } size_t j = 0; uint32_t accum = 0; for (size_t i = 0; i < n; ++i) { -- cgit v1.1