Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1efa35d1 authored by Dongwon Kang's avatar Dongwon Kang Committed by android-build-merger
Browse files

Merge "MPEG4Extractor: check size for yrrc box" into lmp-dev am: d971d188... 

Merge "MPEG4Extractor: check size for yrrc box" into lmp-dev am: d971d188 am: 2ace148c am: 18a67176 am: 6ce4126a am: 040485c1 am: 6e5ef730 am: 9262a0d5 am: 7c70a548
am: e4c62e45

Change-Id: I164f086c1902fe315ae08c69b2a6287d4cbeb135
parents 9dd993e5 e4c62e45

media/libstagefright/MPEG4Extractor.cpp

+9 −0
Original line number Diff line number Diff line
@@ -2984,6 +2984,13 @@ status_t MPEG4Extractor::parse3GPPMetaData(off64_t offset, size_t size, int dept 
        }

        case FOURCC('y', 'r', 'r', 'c'):

        {

            if (size < 6) {

                delete[] buffer;

                buffer = NULL;

                ALOGE("b/62133227");

                android_errorWriteLog(0x534e4554, "62133227");

                return ERROR_MALFORMED;

            }

            char tmp[5];

            uint16_t year = U16_AT(&buffer[4]);
@@ -3006,6 +3013,8 @@ status_t MPEG4Extractor::parse3GPPMetaData(off64_t offset, size_t size, int dept 


        // smallest possible valid UTF-16 string w BOM: 0xfe 0xff 0x00 0x00

        if (size < 6) {

            delete[] buffer;

            buffer = NULL;

            return ERROR_MALFORMED;

        }