Limit mp4 atom size to something reasonable (569f3db6) · Commits · e / os / android_frameworks_av

media/libstagefright/MPEG4Extractor.cpp

+15 −0

Original line number	Diff line number	Diff line
		@@ -23,6 +23,8 @@
		#include "include/ESDS.h"

		#include <ctype.h>
		#define __STDC_FORMAT_MACROS 1
		#include <inttypes.h>
		#include <stdint.h>
		#include <stdlib.h>
		#include <string.h>
		@@ -45,6 +47,12 @@

		namespace android {

		enum {
		// maximum size of an atom. Some atoms can be bigger according to the spec,
		// but we only allow up to this size.
		kMaxAtomSize = 64 * 1024 * 1024,
		};

		class MPEG4Source : public MediaSource {
		public:
		// Caller retains ownership of both "dataSource" and "sampleTable".
		@@ -795,6 +803,13 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {
		PathAdder autoAdder(&mPath, chunk_type);

		off64_t chunk_data_size = *offset + chunk_size - data_offset;
		if (chunk_type != FOURCC('m', 'd', 'a', 't') && chunk_data_size > kMaxAtomSize) {
		char errMsg[100];
		sprintf(errMsg, "%s atom has size %" PRId64, chunk, chunk_data_size);
		ALOGE("%s (b/28615448)", errMsg);
		android_errorWriteWithInfoLog(0x534e4554, "28615448", -1, errMsg, strlen(errMsg));
		return ERROR_MALFORMED;
		}

		if (chunk_type != FOURCC('c', 'p', 'r', 't')
		&& chunk_type != FOURCC('c', 'o', 'v', 'r')