Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e457eb05 authored by Wei Jia's avatar Wei Jia
Browse files

resolved conflicts for 3b8747ca to lmp-mr1-ub-dev 

Merge commit '3b8747ca' into HEAD

libstagefright: sanity check size before dereferencing pointer in Utils.cpp

Also remove some CHECK's.

Bug: 23680780
(cherry picked from commit 7bb772e0)

Change-Id: I5b919716178eb3ba844b21e497b792e6ac61554d
parents 4abb48c3 3b8747ca

media/libstagefright/Utils.cpp

+28 −8
Original line number Original line Diff line number Diff line
@@ -196,8 +196,10 @@ status_t convertMetaDataToMessage( 




        const uint8_t *ptr = (const uint8_t *)data;

        const uint8_t *ptr = (const uint8_t *)data;





        CHECK(size >= 7);

        if (size < 7 || ptr[0] != 1) {  // configurationVersion == 1

        CHECK_EQ((unsigned)ptr[0], 1u);  // configurationVersion == 1

            ALOGE("b/23680780");

            return BAD_VALUE;

        }

        uint8_t profile __unused = ptr[1];

        uint8_t profile __unused = ptr[1];

        uint8_t level __unused = ptr[3];

        uint8_t level __unused = ptr[3];
@@ -223,7 +225,10 @@ status_t convertMetaDataToMessage( 
        buffer->setRange(0, 0);

        buffer->setRange(0, 0);





        for (size_t i = 0; i < numSeqParameterSets; ++i) {

        for (size_t i = 0; i < numSeqParameterSets; ++i) {

            CHECK(size >= 2);

            if (size < 2) {

                ALOGE("b/23680780");

                return BAD_VALUE;

            }

            size_t length = U16_AT(ptr);

            size_t length = U16_AT(ptr);





            ptr += 2;

            ptr += 2;
@@ -252,13 +257,19 @@ status_t convertMetaDataToMessage( 
        }

        }

        buffer->setRange(0, 0);

        buffer->setRange(0, 0);





        CHECK(size >= 1);

        if (size < 1) {

            ALOGE("b/23680780");

            return BAD_VALUE;

        }

        size_t numPictureParameterSets = *ptr;

        size_t numPictureParameterSets = *ptr;

        ++ptr;

        ++ptr;

        --size;

        --size;





        for (size_t i = 0; i < numPictureParameterSets; ++i) {

        for (size_t i = 0; i < numPictureParameterSets; ++i) {

            CHECK(size >= 2);

            if (size < 2) {

                ALOGE("b/23680780");

                return BAD_VALUE;

            }

            size_t length = U16_AT(ptr);

            size_t length = U16_AT(ptr);





            ptr += 2;

            ptr += 2;
@@ -282,8 +293,10 @@ status_t convertMetaDataToMessage( 
    } else if (meta->findData(kKeyHVCC, &type, &data, &size)) {

    } else if (meta->findData(kKeyHVCC, &type, &data, &size)) {

        const uint8_t *ptr = (const uint8_t *)data;

        const uint8_t *ptr = (const uint8_t *)data;





        CHECK(size >= 7);

        if (size < 23 || ptr[0] != 1) {  // configurationVersion == 1

        CHECK_EQ((unsigned)ptr[0], 1u);  // configurationVersion == 1

            ALOGE("b/23680780");

            return BAD_VALUE;

        }

        uint8_t profile __unused = ptr[1] & 31;

        uint8_t profile __unused = ptr[1] & 31;

        uint8_t level __unused = ptr[12];

        uint8_t level __unused = ptr[12];

        ptr += 22;

        ptr += 22;
@@ -302,6 +315,10 @@ status_t convertMetaDataToMessage( 
        buffer->setRange(0, 0);

        buffer->setRange(0, 0);





        for (i = 0; i < numofArrays; i++) {

        for (i = 0; i < numofArrays; i++) {

            if (size < 3) {

                ALOGE("b/23680780");

                return BAD_VALUE;

            }

            ptr += 1;

            ptr += 1;

            size -= 1;

            size -= 1;
@@ -312,7 +329,10 @@ status_t convertMetaDataToMessage( 
            size -= 2;

            size -= 2;





            for (j = 0; j < numofNals; j++) {

            for (j = 0; j < numofNals; j++) {

                CHECK(size >= 2);

                if (size < 2) {

                    ALOGE("b/23680780");

                    return BAD_VALUE;

                }

                size_t length = U16_AT(ptr);

                size_t length = U16_AT(ptr);





                ptr += 2;

                ptr += 2;