Merge "Prevent integer underflow if size is below 6" (2be55471) · Commits · e / os / android_frameworks_av

media/libstagefright/MPEG4Extractor.cpp

+4 −0

Original line number	Diff line number	Diff line
		@@ -2480,6 +2480,10 @@ status_t MPEG4Extractor::parse3GPPMetaData(off64_t offset, size_t size, int dept
		int len16 = 0; // Number of UTF-16 characters

		// smallest possible valid UTF-16 string w BOM: 0xfe 0xff 0x00 0x00
		if (size < 6) {
		return ERROR_MALFORMED;
		}

		if (size - 6 >= 4) {
		len16 = ((size - 6) / 2) - 1; // don't include 0x0000 terminator
		framedata = (char16_t *)(buffer + 6);