Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1f873167 authored by Robert Shih's avatar Robert Shih
Browse files

ANetworkSession: avoid overflow in readMore 

Bug: 25111892
Change-Id: I359c307d605069ec5a484aa18ff54e07f8e923a9
parent 172b675b

media/libstagefright/foundation/ANetworkSession.cpp

+2 −2
Original line number Diff line number Diff line
@@ -457,7 +457,7 @@ status_t ANetworkSession::Session::readMore() { 
        while (mInBuffer.size() >= 2) {

            size_t offset = 2;



            unsigned payloadLen = data[1] & 0x7f;

            uint64_t payloadLen = data[1] & 0x7f;

            if (payloadLen == 126) {

                if (offset + 2 > mInBuffer.size()) {

                    break;
@@ -485,7 +485,7 @@ status_t ANetworkSession::Session::readMore() { 
                offset += 4;

            }



            if (offset + payloadLen > mInBuffer.size()) {

            if (payloadLen > mInBuffer.size() || offset > mInBuffer.size() - payloadLen) {

                break;

            }