Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5cae16bd authored by Wei Jia's avatar Wei Jia
Browse files

MPEG4Extractor: ensure buffer size is not less than 8 for LastCommentData. 

Bug: 24346430
Change-Id: I897a724e968841d9160f819d06c0ce22f6d743c4
parent a9a899d3

media/libstagefright/MPEG4Extractor.cpp

+6 −0
Original line number Diff line number Diff line
@@ -2564,6 +2564,12 @@ status_t MPEG4Extractor::parseITunesMetaData(off64_t offset, size_t size) { 
                    mLastCommentName.setTo((const char *)buffer + 4);

                    break;

                case FOURCC('d', 'a', 't', 'a'):

                    if (size < 8) {

                        delete[] buffer;

                        buffer = NULL;

                        ALOGE("b/24346430");

                        return ERROR_MALFORMED;

                    }

                    mLastCommentData.setTo((const char *)buffer + 8);

                    break;

            }