Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 663837d4 authored by Marco Nelissen's avatar Marco Nelissen Committed by android-build-merger
Browse files

Limit mp4 atom size to something reasonable am: 2fae4e4c am: 53e3ccc7 

am: 8e409923

Change-Id: I6ba013aa9938270be4934f42da25a004f901d1f0
parents 501a17e5 8e409923

media/libstagefright/MPEG4Extractor.cpp

+11 −0
Original line number Diff line number Diff line
@@ -55,6 +55,10 @@ namespace android { 
enum {

    // max track header chunk to return

    kMaxTrackHeaderSize = 32,



    // maximum size of an atom. Some atoms can be bigger according to the spec,

    // but we only allow up to this size.

    kMaxAtomSize = 64 * 1024 * 1024,

};



class MPEG4Source : public MediaSource {
@@ -884,6 +888,13 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { 
        ALOGE("b/23540914");

        return ERROR_MALFORMED;

    }

    if (chunk_type != FOURCC('m', 'd', 'a', 't') && chunk_data_size > kMaxAtomSize) {

        char errMsg[100];

        sprintf(errMsg, "%s atom has size %" PRId64, chunk, chunk_data_size);

        ALOGE("%s (b/28615448)", errMsg);

        android_errorWriteWithInfoLog(0x534e4554, "28615448", -1, errMsg, strlen(errMsg));

        return ERROR_MALFORMED;

    }



    if (chunk_type != FOURCC('c', 'p', 'r', 't')

            && chunk_type != FOURCC('c', 'o', 'v', 'r')