Merge "libstagefright: fix overflow in... (1bbf2488) · Commits · e / os / android_frameworks_av

media/libstagefright/MPEG4Extractor.cpp

+15 −1

Original line number	Diff line number	Diff line
		@@ -3584,13 +3584,27 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets(
		return ERROR_IO;
		}
		offset += 4;
		if (entrycount == 0) {
		return OK;
		}
		if (entrycount > UINT32_MAX / 8) {
		return ERROR_MALFORMED;
		}

		if (entrycount > mCurrentSampleInfoOffsetsAllocSize) {
		mCurrentSampleInfoOffsets = (uint64_t) realloc(mCurrentSampleInfoOffsets, entrycount 8);
		uint64_t newPtr = (uint64_t )realloc(mCurrentSampleInfoOffsets, entrycount * 8);
		if (newPtr == NULL) {
		return NO_MEMORY;
		}
		mCurrentSampleInfoOffsets = newPtr;
		mCurrentSampleInfoOffsetsAllocSize = entrycount;
		}
		mCurrentSampleInfoOffsetCount = entrycount;

		if (mCurrentSampleInfoOffsets == NULL) {
		return OK;
		}

		for (size_t i = 0; i < entrycount; i++) {
		if (version == 0) {
		uint32_t tmp;