Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3d3a3308 authored by Robert Shih's avatar Robert Shih Committed by Ryan Longair
Browse files

AACExtractor: check bounds during seek 

Bug: 70239507
Test: stagefright -a poc.aac
Change-Id: I61225a04c76fe8855bd2591fb14b734099fa3be6
(cherry picked from commit 07905810)
parent d4b23489

media/libstagefright/AACExtractor.cpp

+4 −0
Original line number Diff line number Diff line
@@ -294,6 +294,10 @@ status_t AACSource::read( 
    if (options && options->getSeekTo(&seekTimeUs, &mode)) {

        if (mFrameDurationUs > 0) {

            int64_t seekFrame = seekTimeUs / mFrameDurationUs;

            if (seekFrame < 0 || seekFrame >= (int64_t)mOffsetVector.size()) {

                android_errorWriteLog(0x534e4554, "70239507");

                return ERROR_MALFORMED;

            }

            mCurrentTimeUs = seekFrame * mFrameDurationUs;



            mOffset = mOffsetVector.itemAt(seekFrame);