Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0d83cf22 authored by Robert Shih's avatar Robert Shih Committed by Android Git Automerger
Browse files

am 97d917bc: am ab0b3212: am 9b51a37f: am cb5dc219: am 74abb1ae: am 482b18bb:... 

am 97d917bc: am ab0b3212: am 9b51a37f: am cb5dc219: am 74abb1ae: am 482b18bb: am f106b199: SampleTable: check integer overflow during table alloc

* commit '97d917bc':
  SampleTable: check integer overflow during table alloc
parents 01eed3c0 97d917bc

media/libstagefright/SampleTable.cpp

+14 −0
Original line number Diff line number Diff line
@@ -330,6 +330,10 @@ status_t SampleTable::setTimeToSampleParams( 
    }



    mTimeToSampleCount = U32_AT(&header[4]);

    uint64_t allocSize = mTimeToSampleCount * 2 * sizeof(uint32_t);

    if (allocSize > SIZE_MAX) {

        return ERROR_OUT_OF_RANGE;

    }

    mTimeToSample = new uint32_t[mTimeToSampleCount * 2];



    size_t size = sizeof(uint32_t) * mTimeToSampleCount * 2;
@@ -372,6 +376,11 @@ status_t SampleTable::setCompositionTimeToSampleParams( 
    }



    mNumCompositionTimeDeltaEntries = numEntries;

    uint64_t allocSize = numEntries * 2 * sizeof(uint32_t);

    if (allocSize > SIZE_MAX) {

        return ERROR_OUT_OF_RANGE;

    }



    mCompositionTimeDeltaEntries = new uint32_t[2 * numEntries];



    if (mDataSource->readAt(
@@ -417,6 +426,11 @@ status_t SampleTable::setSyncSampleParams(off64_t data_offset, size_t data_size) 
        ALOGV("Table of sync samples is empty or has only a single entry!");

    }



    uint64_t allocSize = mNumSyncSamples * sizeof(uint32_t);

    if (allocSize > SIZE_MAX) {

        return ERROR_OUT_OF_RANGE;

    }



    mSyncSamples = new uint32_t[mNumSyncSamples];

    size_t size = mNumSyncSamples * sizeof(uint32_t);

    if (mDataSource->readAt(mSyncSampleOffset + 8, mSyncSamples, size)