Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1c2dc064 authored by Nick Kralevich's avatar Nick Kralevich Committed by Android (Google) Code Review
Browse files

Merge "Fix integer underflow in ESDS processing"

parents 3ab51eec 07c0f59d

media/libstagefright/ESDS.cpp

+6 −0
Original line number Diff line number Diff line
@@ -136,6 +136,8 @@ status_t ESDS::parseESDescriptor(size_t offset, size_t size) { 
    --size;



    if (streamDependenceFlag) {

        if (size < 2)

            return ERROR_MALFORMED;

        offset += 2;

        size -= 2;

    }
@@ -145,11 +147,15 @@ status_t ESDS::parseESDescriptor(size_t offset, size_t size) { 
            return ERROR_MALFORMED;

        }

        unsigned URLlength = mData[offset];

        if (URLlength >= size)

            return ERROR_MALFORMED;

        offset += URLlength + 1;

        size -= URLlength + 1;

    }



    if (OCRstreamFlag) {

        if (size < 2)

            return ERROR_MALFORMED;

        offset += 2;

        size -= 2;