Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 073e4f67 authored by Marco Nelissen's avatar Marco Nelissen Committed by Abhishek Arya
Browse files

Check vector size before accessing 

Bug: 22388975
Change-Id: I3c157b1029d37f6a22e6302ea7b52077fe27ce53
(cherry picked from commit 529c595b)
parent 3ce29384

media/libstagefright/MPEG4Extractor.cpp

+9 −0
Original line number Diff line number Diff line
@@ -2747,8 +2747,17 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets(off64_t offset, off 
    int ivlength;

    CHECK(mFormat->findInt32(kKeyCryptoDefaultIVSize, &ivlength));



    // only 0, 8 and 16 byte initialization vectors are supported

    if (ivlength != 0 && ivlength != 8 && ivlength != 16) {

        ALOGW("unsupported IV length: %d", ivlength);

        return ERROR_MALFORMED;

    }

    // read CencSampleAuxiliaryDataFormats

    for (size_t i = 0; i < mCurrentSampleInfoCount; i++) {

        if (i >= mCurrentSamples.size()) {

            ALOGW("too few samples");

            break;

        }

        Sample *smpl = &mCurrentSamples.editItemAt(i);



        memset(smpl->iv, 0, 16);