Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4d344327 authored by Neel Mehta's avatar Neel Mehta
Browse files

Check for out of bounds reads in ESQueue. 

Bug: 23221340

Change-Id: Ie77d176410d0aa5e79624082c578cc3eaa6c1726
parent f87e6ca5

media/libstagefright/mpeg2ts/ESQueue.cpp

+4 −0
Original line number Original line Diff line number Diff line
@@ -1120,6 +1120,10 @@ sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitMPEGVideo() { 
        }

        }





        if (mFormat != NULL && currentStartCode == 0xb8) {

        if (mFormat != NULL && currentStartCode == 0xb8) {

            if (offset + 7 <= size) {

                ALOGE("Size too small");

                return NULL;

            }

            // GOP layer

            // GOP layer

            gopFound = true;

            gopFound = true;

            isClosedGop = (data[offset + 7] & 0x40) != 0;

            isClosedGop = (data[offset + 7] & 0x40) != 0;