Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0f2041fd authored by Santiago Seifert's avatar Santiago Seifert
Browse files

Abort operation upon arithmetic overflows 

Bug: 185394935
Test: atest CtsMediaTestCases:MediaExtractorTest
Test: atest CtsMediaTestCases:MediaPlayerTest
Change-Id: Idf119d823318645fb751f99191a7b80b09ae551a
parent 8c3219d7

media/extractors/mp3/MP3Extractor.cpp

+8 −1
Original line number Diff line number Diff line
@@ -504,7 +504,14 @@ media_status_t MP3Source::read( 
            }



            mCurrentTimeUs = seekTimeUs;

            mCurrentPos = mFirstFramePos + seekTimeUs * bitrate / 8000000;

            int64_t seekTimeUsTimesBitrate;

            if (__builtin_mul_overflow(seekTimeUs, bitrate, &seekTimeUsTimesBitrate)) {

              return AMEDIA_ERROR_UNSUPPORTED;

            }

            if (__builtin_add_overflow(

                    mFirstFramePos, seekTimeUsTimesBitrate / 8000000, &mCurrentPos)) {

                return AMEDIA_ERROR_UNSUPPORTED;

            }

            seekCBR = true;

        } else {

            mCurrentTimeUs = actualSeekTimeUs;