Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 303a2c2b authored by Patrik2 Carlsson's avatar Patrik2 Carlsson Committed by Takahiro Aizawa
Browse files

Avoid parsing CC SEI payload beyond buffer end 

Break CC SEI parsing when payload size exceeds buffer size
to avoid a CHECK that have been seen in MTBF statistics.

Change-Id: Ifd97648678a935ac815dd616301d46f9bf583838
parent 2d772fd4

media/libmediaplayerservice/nuplayer/NuPlayerCCDecoder.cpp

+6 −0
Original line number Diff line number Diff line
@@ -235,6 +235,12 @@ bool NuPlayer::CCDecoder::parseSEINalUnit( 
            payload_size += last_byte;

        } while (last_byte == 0xFF);



        if (payload_size > SIZE_MAX / 8

                || !br.atLeastNumBitsLeft(payload_size * 8)) {

            ALOGV("Malformed SEI payload");

            break;

        }



        // sei_payload()

        if (payload_type == 4) {

            bool isCC = false;