Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 306aad77 authored by Santiago Seifert's avatar Santiago Seifert
Browse files

Avoid read out of bounds 

Bug: 230493653
Change-Id: Ieca5a5390d3cf73fff6aa552d065363d84e1ccc2
Test: See bug for PoC.
parent de0580d5

media/extractors/mp4/MPEG4Extractor.cpp

+1 −1
Original line number Original line Diff line number Diff line
@@ -4775,7 +4775,7 @@ status_t MPEG4Extractor::updateAudioTrackInfoFromESDS_MPEG4Audio( 
        if (len2 == 0) {

        if (len2 == 0) {

            return ERROR_MALFORMED;

            return ERROR_MALFORMED;

        }

        }

        if (offset >= csd_size || csd[offset] != 0x01) {

        if (offset + len1 > csd_size || csd[offset] != 0x01) {

            return ERROR_MALFORMED;

            return ERROR_MALFORMED;

        }

        }