Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 22385646 authored by Presubmit Automerger Backend's avatar Presubmit Automerger Backend Committed by Ian Baker
Browse files

Fix Unsigned-integer-overflow in MPEG4Extractor 2p: b83c4389 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/20022985

Bug: 232242894
Change-Id: I20ab6d78f47898cea6d0dc8465b8ad80e1107ec3
parents 60c53419 b83c4389

media/module/extractors/mp4/MPEG4Extractor.cpp

+15 −4
Original line number Diff line number Diff line
@@ -5908,12 +5908,18 @@ status_t MPEG4Source::parseTrackFragmentRun(off64_t offset, off64_t size) { 
            return -EINVAL;

        }



        int32_t dataOffsetDelta;

        if (!mDataSource->getUInt32(offset, (uint32_t*)&dataOffsetDelta)) {

        uint32_t dataOffsetDelta;

        if (!mDataSource->getUInt32(offset, &dataOffsetDelta)) {

            return ERROR_MALFORMED;

        }



        dataOffset = mTrackFragmentHeaderInfo.mBaseDataOffset + dataOffsetDelta;

        if (__builtin_add_overflow(

                mTrackFragmentHeaderInfo.mBaseDataOffset, dataOffsetDelta, &dataOffset)) {

            ALOGW("b/232242894 mBaseDataOffset(%" PRIu64 ") + dataOffsetDelta(%u) overflows uint64",

                    mTrackFragmentHeaderInfo.mBaseDataOffset, dataOffsetDelta);

            android_errorWriteLog(0x534e4554, "232242894");

            return ERROR_MALFORMED;

        }



        offset += 4;

        size -= 4;
@@ -6047,7 +6053,12 @@ status_t MPEG4Source::parseTrackFragmentRun(off64_t offset, off64_t size) { 
            return NO_MEMORY;

        }



        dataOffset += sampleSize;

        if (__builtin_add_overflow(dataOffset, sampleSize, &dataOffset)) {

            ALOGW("b/232242894 dataOffset(%" PRIu64 ") + sampleSize(%u) overflows uint64",

                    dataOffset, sampleSize);

            android_errorWriteLog(0x534e4554, "232242894");

            return ERROR_MALFORMED;

        }

    }



    mTrackFragmentHeaderInfo.mDataOffset = dataOffset;