Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 616bd340 authored by Ray Essick's avatar Ray Essick
Browse files

Safe parsing of HEIF framecount information 

Bug: 215002587
Test: POC described in bug
Change-Id: I92f8fdfe860cb360fb0ae099db3c92776ba7390f
(cherry picked from commit e89e632f)
parent 21f7fa7b

media/libheif/HeifDecoderImpl.cpp

+8 −1
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ 
#include <binder/IMemory.h>

#include <binder/MemoryDealer.h>

#include <drm/drm_framework_common.h>

#include <log/log.h>

#include <media/mediametadataretriever.h>

#include <media/stagefright/MediaSource.h>

#include <media/stagefright/foundation/ADebug.h>
@@ -421,7 +422,13 @@ bool HeifDecoderImpl::reinit(HeifFrameInfo* frameInfo) { 


        initFrameInfo(&mSequenceInfo, videoFrame);



        mSequenceLength = atoi(mRetriever->extractMetadata(METADATA_KEY_VIDEO_FRAME_COUNT));

        const char* frameCount = mRetriever->extractMetadata(METADATA_KEY_VIDEO_FRAME_COUNT);

        if (frameCount == nullptr) {

            android_errorWriteWithInfoLog(0x534e4554, "215002587", -1, NULL, 0);

            ALOGD("No valid sequence information in metadata");

            return false;

        }

        mSequenceLength = atoi(frameCount);



        if (defaultInfo == nullptr) {

            defaultInfo = &mSequenceInfo;