Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3056e554 authored by Wei Jia's avatar Wei Jia Committed by Android Git Automerger
Browse files

am c1768c9d: am 268b9692: am 9a4da6b1: am c98f2a0a: am e0095a19: am 86174e2c:... 

am c1768c9d: am 268b9692: am 9a4da6b1: am c98f2a0a: am e0095a19: am 86174e2c: Merge "Prevent reading past the end of the buffer in 3GPP" into lmp-dev

* commit 'c1768c9d':
  Prevent reading past the end of the buffer in 3GPP
parents acf52af6 c1768c9d

media/libstagefright/MPEG4Extractor.cpp

+3 −2
Original line number Diff line number Diff line
@@ -2403,11 +2403,11 @@ status_t MPEG4Extractor::parseITunesMetaData(off64_t offset, size_t size) { 
}



status_t MPEG4Extractor::parse3GPPMetaData(off64_t offset, size_t size, int depth) {

    if (size < 4) {

    if (size < 4 || size == SIZE_MAX) {

        return ERROR_MALFORMED;

    }



    uint8_t *buffer = new (std::nothrow) uint8_t[size];

    uint8_t *buffer = new (std::nothrow) uint8_t[size + 1];

    if (buffer == NULL) {

        return ERROR_MALFORMED;

    }
@@ -2503,6 +2503,7 @@ status_t MPEG4Extractor::parse3GPPMetaData(off64_t offset, size_t size, int dept 
        }



        if (isUTF8) {

            buffer[size] = 0;

            mFileMetaData->setCString(metadataKey, (const char *)buffer + 6);

        } else {

            // Convert from UTF-16 string to UTF-8 string.