From c24607c29c96f939aed9e33bfa702b1dd79da4b7 Mon Sep 17 00:00:00 2001 From: "Joshua J. Drake" Date: Wed, 8 Apr 2015 23:44:57 -0500 Subject: Fix integer overflow during MP4 atom processing A few sample table related FourCC values are handled by the setSampleToChunkParams function. An integer overflow exists within this function. Validate that mNumSampleToChunkOffets will not cause an integer overflow. Bug: 20139950 Change-Id: I1972cc185fce5e058afa143ad5eabcc269ad324d --- media/libstagefright/SampleTable.cpp | 3 +++ 1 file changed, 3 insertions(+) (limited to 'media') diff --git a/media/libstagefright/SampleTable.cpp b/media/libstagefright/SampleTable.cpp index bfae474..aba64d5 100644 --- a/media/libstagefright/SampleTable.cpp +++ b/media/libstagefright/SampleTable.cpp @@ -230,6 +230,9 @@ status_t SampleTable::setSampleToChunkParams( return ERROR_MALFORMED; } + if (SIZE_MAX / sizeof(SampleToChunkEntry) <= mNumSampleToChunkOffsets) + return ERROR_OUT_OF_RANGE; + mSampleToChunkEntries = new (std::nothrow) SampleToChunkEntry[mNumSampleToChunkOffsets]; if (!mSampleToChunkEntries) -- cgit v1.1