Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4eba6fd3 authored by Jon Larimer's avatar Jon Larimer Committed by Android Git Automerger
Browse files

am 800e479f: Merge "Prevent integer overflow when processing covr MPEG4 atoms" 

* commit '800e479f':
  Prevent integer overflow when processing covr MPEG4 atoms
parents 30aa138d 800e479f

media/libstagefright/MPEG4Extractor.cpp

+5 −1
Original line number Original line Diff line number Diff line
@@ -1935,7 +1935,11 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { 




            if (mFileMetaData != NULL) {

            if (mFileMetaData != NULL) {

                ALOGV("chunk_data_size = %lld and data_offset = %lld",

                ALOGV("chunk_data_size = %lld and data_offset = %lld",

                        chunk_data_size, data_offset);

                        (long long)chunk_data_size, (long long)data_offset);



                if (chunk_data_size >= SIZE_MAX - 1) {

                    return ERROR_MALFORMED;

                }

                sp<ABuffer> buffer = new ABuffer(chunk_data_size + 1);

                sp<ABuffer> buffer = new ABuffer(chunk_data_size + 1);

                if (mDataSource->readAt(

                if (mDataSource->readAt(

                    data_offset, buffer->data(), chunk_data_size) != (ssize_t)chunk_data_size) {

                    data_offset, buffer->data(), chunk_data_size) != (ssize_t)chunk_data_size) {