Fix out-of-bounds write

                    continue;

                }

                CHECK(dstOffset + 4 <= mBuffer->size());

                if (dstOffset > SIZE_MAX - 4 ||

                        dstOffset + 4 > SIZE_MAX - nalLength ||

                        dstOffset + 4 + nalLength > mBuffer->size()) {

                    ALOGE("b/26365349 : %zu %zu", dstOffset, mBuffer->size());

                    android_errorWriteLog(0x534e4554, "26365349");

                    mBuffer->release();

                    mBuffer = NULL;

                    return ERROR_MALFORMED;

                }

                dstData[dstOffset++] = 0;

                dstData[dstOffset++] = 0;