From f9e8f2fcaad04776a93bc659a9d9017011fcb085 Mon Sep 17 00:00:00 2001
From: Chad Brubaker <cbrubaker@google.com>
Date: Wed, 7 Oct 2015 15:42:11 -0700
Subject: Fix benign overflow in getTimeUsOfGranule

Bug: 24748446
Change-Id: I1f8e3927e9a8f646a0d804161924ae0dcc5ab75d
---
 media/libstagefright/OggExtractor.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'media')

diff --git a/media/libstagefright/OggExtractor.cpp b/media/libstagefright/OggExtractor.cpp
index 578171f..5c81f1a 100644
--- a/media/libstagefright/OggExtractor.cpp
+++ b/media/libstagefright/OggExtractor.cpp
@@ -179,6 +179,9 @@ struct MyVorbisExtractor : public MyOggExtractor {
 
 protected:
     virtual int64_t getTimeUsOfGranule(uint64_t granulePos) const {
+        if (granulePos > INT64_MAX / 1000000ll) {
+            return INT64_MAX;
+        }
         return granulePos * 1000000ll / mVi.rate;
     }
 
@@ -917,6 +920,9 @@ int64_t MyOpusExtractor::getTimeUsOfGranule(uint64_t granulePos) const {
     if (granulePos > mCodecDelay) {
         pcmSamplePosition = granulePos - mCodecDelay;
     }
+    if (pcmSamplePosition > INT64_MAX / 1000000ll) {
+        return INT64_MAX;
+    }
     return pcmSamplePosition * 1000000ll / kOpusSampleRate;
 }
 
-- 
cgit v1.1