Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 529c595b authored by Marco Nelissen's avatar Marco Nelissen
Browse files

Check vector size before accessing

Bug: 22388975
Change-Id: I3c157b1029d37f6a22e6302ea7b52077fe27ce53
parent 6134ad6f
Loading
Loading
Loading
Loading
+9 −0
Original line number Diff line number Diff line
@@ -3587,8 +3587,17 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets(
    int ivlength;
    CHECK(mFormat->findInt32(kKeyCryptoDefaultIVSize, &ivlength));

    // only 0, 8 and 16 byte initialization vectors are supported
    if (ivlength != 0 && ivlength != 8 && ivlength != 16) {
        ALOGW("unsupported IV length: %d", ivlength);
        return ERROR_MALFORMED;
    }
    // read CencSampleAuxiliaryDataFormats
    for (size_t i = 0; i < mCurrentSampleInfoCount; i++) {
        if (i >= mCurrentSamples.size()) {
            ALOGW("too few samples");
            break;
        }
        Sample *smpl = &mCurrentSamples.editItemAt(i);

        memset(smpl->iv, 0, 16);