Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0071d87e authored by Robert Shih's avatar Robert Shih Committed by The Android Automerger
Browse files

MatroskaExtractor: detect infinite loop when parsing NALs 

Bug: 21335999
Change-Id: I76bd34610e52048ffcf16e41aa6175afc8a14ee4
(cherry picked from commit 2dcf6138)
parent 04140c86

media/libstagefright/matroska/MatroskaExtractor.cpp

+7 −1
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ 
#include "MatroskaExtractor.h"



#include <media/stagefright/foundation/ADebug.h>

#include <media/stagefright/foundation/AUtils.h>

#include <media/stagefright/foundation/hexdump.h>

#include <media/stagefright/DataSource.h>

#include <media/stagefright/MediaBuffer.h>
@@ -631,7 +632,12 @@ status_t MatroskaSource::read( 
                    TRESPASS();

            }



            if (srcOffset + mNALSizeLen + NALsize > srcSize) {

            if (srcOffset + mNALSizeLen + NALsize <= srcOffset + mNALSizeLen) {

                frame->release();

                frame = NULL;



                return ERROR_MALFORMED;

            } else if (srcOffset + mNALSizeLen + NALsize > srcSize) {

                break;

            }