Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5fc24a5a authored by Robert Shih's avatar Robert Shih Committed by Brint E. Kriebel
Browse files

MatroskaExtractor: detect infinite loop when parsing NALs 

Bug: 21335999
Change-Id: I76bd34610e52048ffcf16e41aa6175afc8a14ee4
(cherry picked from commit 2dcf6138)
Ticket: CYNGNOS-985
parent d1efa0b1

media/libstagefright/matroska/MatroskaExtractor.cpp

+7 −1
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ 
#include "MatroskaExtractor.h"



#include <media/stagefright/foundation/ADebug.h>

#include <media/stagefright/foundation/AUtils.h>

#include <media/stagefright/foundation/hexdump.h>

#include <media/stagefright/DataSource.h>

#include <media/stagefright/MediaBuffer.h>
@@ -693,7 +694,12 @@ status_t MatroskaSource::read( 
                    TRESPASS();

            }



            if (srcOffset + mNALSizeLen + NALsize > srcSize) {

            if (srcOffset + mNALSizeLen + NALsize <= srcOffset + mNALSizeLen) {

                frame->release();

                frame = NULL;



                return ERROR_MALFORMED;

            } else if (srcOffset + mNALSizeLen + NALsize > srcSize) {

                break;

            }