diff options
author | Andreas Huber <andih@google.com> | 2010-06-24 12:16:25 -0700 |
---|---|---|
committer | Andreas Huber <andih@google.com> | 2010-06-24 12:16:25 -0700 |
commit | 736c22d3e0b96a45e46ce43ac20a48ecbc373db7 (patch) | |
tree | 2bb0a22863ec6f8915f10125f5bf9d3ad1ccbb11 /media | |
parent | a2549bb644d8ca4b0209d6d2f0c4160521789aa9 (diff) | |
download | frameworks_base-736c22d3e0b96a45e46ce43ac20a48ecbc373db7.zip frameworks_base-736c22d3e0b96a45e46ce43ac20a48ecbc373db7.tar.gz frameworks_base-736c22d3e0b96a45e46ce43ac20a48ecbc373db7.tar.bz2 |
Properly identify malformed (too short) chunks in mpeg4 files.
Change-Id: Id2efb1bba195c4ad6f132cd706cc813135ead8a4
Diffstat (limited to 'media')
-rw-r--r-- | media/libstagefright/MPEG4Extractor.cpp | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index 3639db4..0c2f1e6 100644 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -428,6 +428,14 @@ status_t MPEG4Extractor::parseChunk(off_t *offset, int depth) { } chunk_size = ntoh64(chunk_size); data_offset += 8; + + if (chunk_size < 16) { + // The smallest valid chunk is 16 bytes long in this case. + return ERROR_MALFORMED; + } + } else if (chunk_size < 8) { + // The smallest valid chunk is 8 bytes long. + return ERROR_MALFORMED; } char chunk[5]; |