Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3cc11bfc authored by Joshua J. Drake's avatar Joshua J. Drake Committed by Nick Kralevich
Browse files

Fix several ineffective integer overflow checks 

Commit edd4a76e (which addressed bugs 15328708, 15342615, 15342751) added
several integer overflow checks. Unfortunately, those checks fail to take into
account integer promotion rules and are thus themselves subject to an integer
overflow. Cast the sizeof() operator to a uint64_t to force promotion while
multiplying.

Bug: 20139950
Change-Id: Ieb29a170edb805c722fc5658935f2390003e5260
(cherry picked from commit e2e812e5)
parent 6d80b687

media/libstagefright/SampleTable.cpp

+3 −3
Original line number Diff line number Diff line
@@ -330,7 +330,7 @@ status_t SampleTable::setTimeToSampleParams( 
    }



    mTimeToSampleCount = U32_AT(&header[4]);

    uint64_t allocSize = mTimeToSampleCount * 2 * sizeof(uint32_t);

    uint64_t allocSize = mTimeToSampleCount * 2 * (uint64_t)sizeof(uint32_t);

    if (allocSize > SIZE_MAX) {

        return ERROR_OUT_OF_RANGE;

    }
@@ -376,7 +376,7 @@ status_t SampleTable::setCompositionTimeToSampleParams( 
    }



    mNumCompositionTimeDeltaEntries = numEntries;

    uint64_t allocSize = numEntries * 2 * sizeof(uint32_t);

    uint64_t allocSize = numEntries * 2 * (uint64_t)sizeof(uint32_t);

    if (allocSize > SIZE_MAX) {

        return ERROR_OUT_OF_RANGE;

    }
@@ -426,7 +426,7 @@ status_t SampleTable::setSyncSampleParams(off64_t data_offset, size_t data_size) 
        ALOGV("Table of sync samples is empty or has only a single entry!");

    }



    uint64_t allocSize = mNumSyncSamples * sizeof(uint32_t);

    uint64_t allocSize = mNumSyncSamples * (uint64_t)sizeof(uint32_t);

    if (allocSize > SIZE_MAX) {

        return ERROR_OUT_OF_RANGE;

    }