Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3cce4937 authored by Chad Brubaker's avatar Chad Brubaker Committed by Gerrit Code Review
Browse files

Merge "Fix benign overflow in SampleIterator"

parents 49bf1193 cbcd8dd1

media/libstagefright/SampleIterator.cpp

+7 −0
Original line number Diff line number Diff line
@@ -166,6 +166,13 @@ status_t SampleIterator::findChunkRange(uint32_t sampleIndex) { 
        if (mSampleToChunkIndex + 1 < mTable->mNumSampleToChunkOffsets) {

            mStopChunk = entry[1].startChunk;



            if (mStopChunk < mFirstChunk ||

                (mStopChunk - mFirstChunk) > UINT32_MAX / mSamplesPerChunk ||

                ((mStopChunk - mFirstChunk) * mSamplesPerChunk >

                 UINT32_MAX - mFirstChunkSampleIndex)) {



                return ERROR_OUT_OF_RANGE;

            }

            mStopChunkSampleIndex =

                mFirstChunkSampleIndex

                    + (mStopChunk - mFirstChunk) * mSamplesPerChunk;