Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4dad6fcf authored by Dongwon Kang's avatar Dongwon Kang
Browse files

Add more size checking for 'stss' box 

Test: run poc
Bug: 124771364
Change-Id: Id34dea17f78715eb7c44a3959c654b0f09ead3fb
parent c6646397

media/extractors/mp4/SampleTable.cpp

+6 −0
Original line number Original line Diff line number Diff line
@@ -540,6 +540,12 @@ status_t SampleTable::setSyncSampleParams(off64_t data_offset, size_t data_size) 
    }

    }





    uint64_t allocSize = (uint64_t)numSyncSamples * sizeof(uint32_t);

    uint64_t allocSize = (uint64_t)numSyncSamples * sizeof(uint32_t);

    if (allocSize > data_size - 8) {

        ALOGW("b/124771364 - allocSize(%lu) > size(%lu)",

                (unsigned long)allocSize, (unsigned long)(data_size - 8));

        android_errorWriteLog(0x534e4554, "124771364");

        return ERROR_MALFORMED;

    }

    if (allocSize > kMaxTotalSize) {

    if (allocSize > kMaxTotalSize) {

        ALOGE("Sync sample table size too large.");

        ALOGE("Sync sample table size too large.");

        return ERROR_OUT_OF_RANGE;

        return ERROR_OUT_OF_RANGE;