Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 178db0fa authored by Santiago Seifert's avatar Santiago Seifert Committed by Automerger Merge Worker
Browse files

Prevent overflow and out-of-bounds access am: 3d800be2 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/14126886

Change-Id: Ie8cb1598ec70dc39ea0a2bf933201ca2f02945b0
parents 920d2b48 3d800be2

media/extractors/mp4/MPEG4Extractor.cpp

+18 −10
Original line number Diff line number Diff line
@@ -6194,9 +6194,13 @@ media_status_t MPEG4Source::read( 
        if (newBuffer) {

            if (mIsPcm) {

                // The twos' PCM block reader assumes that all samples has the same size.



                uint32_t samplesToRead = mSampleTable->getLastSampleIndexInChunk()

                                                      - mCurrentSampleIndex + 1;

                uint32_t lastSampleIndexInChunk = mSampleTable->getLastSampleIndexInChunk();

                if (lastSampleIndexInChunk < mCurrentSampleIndex) {

                    mBuffer->release();

                    mBuffer = nullptr;

                    return AMEDIA_ERROR_UNKNOWN;

                }

                uint32_t samplesToRead = lastSampleIndexInChunk - mCurrentSampleIndex + 1;

                if (samplesToRead > kMaxPcmFrameSize) {

                    samplesToRead = kMaxPcmFrameSize;

                }
@@ -6206,12 +6210,16 @@ media_status_t MPEG4Source::read( 
                      mSampleTable->getLastSampleIndexInChunk());



                size_t totalSize = samplesToRead * size;

                if (mBuffer->size() < totalSize) {

                    mBuffer->release();

                    mBuffer = nullptr;

                    return AMEDIA_ERROR_UNKNOWN;

                }

                uint8_t* buf = (uint8_t *)mBuffer->data();

                ssize_t bytesRead = mDataSource->readAt(offset, buf, totalSize);

                if (bytesRead < (ssize_t)totalSize) {

                    mBuffer->release();

                    mBuffer = NULL;



                    return AMEDIA_ERROR_IO;

                }