Merge "MPEG4Extractor: check size for yrrc box" into lmp-dev (2ace148c) · Commits · e / devices / smdk4412 / android_frameworks_av

media/libstagefright/MPEG4Extractor.cpp

+9 −0

Original line number	Diff line number	Diff line
		@@ -2598,6 +2598,13 @@ status_t MPEG4Extractor::parse3GPPMetaData(off64_t offset, size_t size, int dept
		}
		case FOURCC('y', 'r', 'r', 'c'):
		{
		if (size < 6) {
		delete[] buffer;
		buffer = NULL;
		ALOGE("b/62133227");
		android_errorWriteLog(0x534e4554, "62133227");
		return ERROR_MALFORMED;
		}
		char tmp[5];
		uint16_t year = U16_AT(&buffer[4]);

		@@ -2620,6 +2627,8 @@ status_t MPEG4Extractor::parse3GPPMetaData(off64_t offset, size_t size, int dept

		// smallest possible valid UTF-16 string w BOM: 0xfe 0xff 0x00 0x00
		if (size < 6) {
		delete[] buffer;
		buffer = NULL;
		return ERROR_MALFORMED;
		}