Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e2e812e5 authored by Joshua J. Drake's avatar Joshua J. Drake Committed by Nick Kralevich
Browse files

Fix several ineffective integer overflow checks 

Commit edd4a76e (which addressed bugs 15328708, 15342615, 15342751) added
several integer overflow checks. Unfortunately, those checks fail to take into
account integer promotion rules and are thus themselves subject to an integer
overflow. Cast the sizeof() operator to a uint64_t to force promotion while
multiplying.

Bug: 20139950
Change-Id: Ieb29a170edb805c722fc5658935f2390003e5260
parent e3e82d54

media/libstagefright/SampleTable.cpp

+3 −3
Original line number Diff line number Diff line
@@ -330,7 +330,7 @@ status_t SampleTable::setTimeToSampleParams( 
    }



    mTimeToSampleCount = U32_AT(&header[4]);

    uint64_t allocSize = mTimeToSampleCount * 2 * sizeof(uint32_t);

    uint64_t allocSize = mTimeToSampleCount * 2 * (uint64_t)sizeof(uint32_t);

    if (allocSize > SIZE_MAX) {

        return ERROR_OUT_OF_RANGE;

    }
@@ -376,7 +376,7 @@ status_t SampleTable::setCompositionTimeToSampleParams( 
    }



    mNumCompositionTimeDeltaEntries = numEntries;

    uint64_t allocSize = numEntries * 2 * sizeof(uint32_t);

    uint64_t allocSize = numEntries * 2 * (uint64_t)sizeof(uint32_t);

    if (allocSize > SIZE_MAX) {

        return ERROR_OUT_OF_RANGE;

    }
@@ -426,7 +426,7 @@ status_t SampleTable::setSyncSampleParams(off64_t data_offset, size_t data_size) 
        ALOGV("Table of sync samples is empty or has only a single entry!");

    }



    uint64_t allocSize = mNumSyncSamples * sizeof(uint32_t);

    uint64_t allocSize = mNumSyncSamples * (uint64_t)sizeof(uint32_t);

    if (allocSize > SIZE_MAX) {

        return ERROR_OUT_OF_RANGE;

    }