Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3473d558 authored by Harish Mahendrakar's avatar Harish Mahendrakar Committed by Ray Essick
Browse files

OpusHeader: Fix integer overflow in GetOpusHeaderBuffers 

unified CSD parsing now checks for valid size of CSD

Bug: 142861738
Test: poc in bug
Test: atest android.media.cts.DecoderTest
Change-Id: Iff742d2fdf4139bab7b5f378c1742ef52c0bbc78
parent f6581aaa

media/libstagefright/foundation/OpusHeader.cpp

+4 −0
Original line number Original line Diff line number Diff line
@@ -292,6 +292,10 @@ bool GetOpusHeaderBuffers(const uint8_t *data, size_t data_size, 
        *opusHeadSize = data_size;

        *opusHeadSize = data_size;

        return true;

        return true;

    } else if (memcmp(AOPUS_CSD_MARKER_PREFIX, data, AOPUS_CSD_MARKER_PREFIX_SIZE) == 0) {

    } else if (memcmp(AOPUS_CSD_MARKER_PREFIX, data, AOPUS_CSD_MARKER_PREFIX_SIZE) == 0) {

        if (data_size < AOPUS_UNIFIED_CSD_MINSIZE || data_size > AOPUS_UNIFIED_CSD_MAXSIZE) {

            ALOGD("Unexpected size for unified opus csd %zu", data_size);

            return false;

        }

        size_t i = 0;

        size_t i = 0;

        bool found = false;

        bool found = false;

        while (i <= data_size - AOPUS_MARKER_SIZE - AOPUS_LENGTH_SIZE) {

        while (i <= data_size - AOPUS_MARKER_SIZE - AOPUS_LENGTH_SIZE) {