Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3fad7852 authored by Joshua J. Drake's avatar Joshua J. Drake Committed by Abhisek Devkota
Browse files

Fix integer underflow in ESDS processing 

Several arithmetic operations within parseESDescriptor could underflow, leading
to an out-of-bounds read operation. Ensure that subtractions from 'size' do not
cause it to wrap around.

Bug: 20139950

(cherry picked from commit 07c0f59d)
(cherry picked from commit 96bd564f)

Change-Id: Iedac935b958223b486c2500546a9aa3a8fe10608
parent eaab5c09

media/libstagefright/ESDS.cpp

+6 −0
Original line number Diff line number Diff line
@@ -136,6 +136,8 @@ status_t ESDS::parseESDescriptor(size_t offset, size_t size) { 
    --size;



    if (streamDependenceFlag) {

        if (size < 2)

            return ERROR_MALFORMED;

        offset += 2;

        size -= 2;

    }
@@ -145,11 +147,15 @@ status_t ESDS::parseESDescriptor(size_t offset, size_t size) { 
            return ERROR_MALFORMED;

        }

        unsigned URLlength = mData[offset];

        if (URLlength >= size)

            return ERROR_MALFORMED;

        offset += URLlength + 1;

        size -= URLlength + 1;

    }



    if (OCRstreamFlag) {

        if (size < 2)

            return ERROR_MALFORMED;

        offset += 2;

        size -= 2;