Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 55658b10 authored by Santiago Seifert's avatar Santiago Seifert
Browse files

Prevent overflow of unsigned variable 

Bug: 184430260
Test: atest CtsMediaTestCases:MediaExtractorTest
Test: atest CtsMediaTestCases:MediaPlayerTest
Test: Ran fuzzer test case in linked bug.
Change-Id: I6e333943c6527dabbf4ad4bd213560952ce0a9c1
parent a69e5dde

media/extractors/mkv/MatroskaExtractor.cpp

+5 −5
Original line number Diff line number Diff line
@@ -1700,17 +1700,17 @@ status_t MatroskaExtractor::synthesizeMPEG2(TrackInfo *trackInfo, size_t index) 
        return ERROR_MALFORMED;

    }



    size_t header_start = 0;

    size_t header_lenth = 0;

    long header_start = 0;

    long header_length = 0;

    for (header_start = 0; header_start < frame.len - 4; header_start++) {

        if (ntohl(0x000001b3) == *(uint32_t*)((uint8_t*)tmpData.get() + header_start)) {

            break;

        }

    }

    bool isComplete_csd = false;

    for (header_lenth = 0; header_lenth < frame.len - 4 - header_start; header_lenth++) {

    for (header_length = 0; header_length < frame.len - 4 - header_start; header_length++) {

        if (ntohl(0x000001b8) == *(uint32_t*)((uint8_t*)tmpData.get()

                                + header_start + header_lenth)) {

                                + header_start + header_length)) {

            isComplete_csd = true;

            break;

        }
@@ -1720,7 +1720,7 @@ status_t MatroskaExtractor::synthesizeMPEG2(TrackInfo *trackInfo, size_t index) 
        return ERROR_MALFORMED;

    }

    addESDSFromCodecPrivate(trackInfo->mMeta, false,

                              (uint8_t*)(tmpData.get()) + header_start, header_lenth);

                            (uint8_t*)(tmpData.get()) + header_start, header_length);



    return OK;