Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0af43510 authored by Wei Jia's avatar Wei Jia Committed by Android Git Automerger
Browse files

am 2562495d: am a590baca: Merge commit \'6ae815e0\' into HEAD

* commit '2562495d':
  libstagefright: fix overflow in MPEG4Source::parseSampleAuxiliaryInformationOffsets.
parents e3cb2507 2562495d
Loading
Loading
Loading
Loading
+19 −1
Original line number Diff line number Diff line
@@ -44,6 +44,10 @@
#include <byteswap.h>
#include "include/ID3.h"

#ifndef UINT32_MAX
#define UINT32_MAX       (4294967295U)
#endif

namespace android {

class MPEG4Source : public MediaSource {
@@ -3322,13 +3326,27 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets(
        return ERROR_IO;
    }
    offset += 4;
    if (entrycount == 0) {
        return OK;
    }
    if (entrycount > UINT32_MAX / 8) {
        return ERROR_MALFORMED;
    }

    if (entrycount > mCurrentSampleInfoOffsetsAllocSize) {
        mCurrentSampleInfoOffsets = (uint64_t*) realloc(mCurrentSampleInfoOffsets, entrycount * 8);
        uint64_t *newPtr = (uint64_t *)realloc(mCurrentSampleInfoOffsets, entrycount * 8);
        if (newPtr == NULL) {
            return NO_MEMORY;
        }
        mCurrentSampleInfoOffsets = newPtr;
        mCurrentSampleInfoOffsetsAllocSize = entrycount;
    }
    mCurrentSampleInfoOffsetCount = entrycount;

    if (mCurrentSampleInfoOffsets == NULL) {
        return OK;
    }

    for (size_t i = 0; i < entrycount; i++) {
        if (version == 0) {
            uint32_t tmp;