Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 407d475b authored by Robert Shih's avatar Robert Shih Committed by Abhishek Arya
Browse files

MatroskaExtractor: detect infinite loop when parsing NALs 

Bug: 21335999
Change-Id: I76bd34610e52048ffcf16e41aa6175afc8a14ee4
(cherry picked from commit 2dcf6138)
parent deba0610

media/libstagefright/matroska/MatroskaExtractor.cpp

+7 −1
Original line number Original line Diff line number Diff line
@@ -23,6 +23,7 @@ 
#include "mkvparser.hpp"

#include "mkvparser.hpp"





#include <media/stagefright/foundation/ADebug.h>

#include <media/stagefright/foundation/ADebug.h>

#include <media/stagefright/foundation/AUtils.h>

#include <media/stagefright/foundation/hexdump.h>

#include <media/stagefright/foundation/hexdump.h>

#include <media/stagefright/DataSource.h>

#include <media/stagefright/DataSource.h>

#include <media/stagefright/MediaBuffer.h>

#include <media/stagefright/MediaBuffer.h>
@@ -563,7 +564,12 @@ status_t MatroskaSource::read( 
                    TRESPASS();

                    TRESPASS();

            }

            }





            if (srcOffset + mNALSizeLen + NALsize > srcSize) {

            if (srcOffset + mNALSizeLen + NALsize <= srcOffset + mNALSizeLen) {

                frame->release();

                frame = NULL;



                return ERROR_MALFORMED;

            } else if (srcOffset + mNALSizeLen + NALsize > srcSize) {

                break;

                break;

            }

            }