Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6fd1cf0c authored by Robert Shih's avatar Robert Shih Committed by Android Git Automerger
Browse files

am 86543654: am 0d83cf22: am 97d917bc: am ab0b3212: am 9b51a37f: am cb5dc219:... 

am 86543654: am 0d83cf22: am 97d917bc: am ab0b3212: am 9b51a37f: am cb5dc219: am 74abb1ae: am 482b18bb: am f106b199: SampleTable: check integer overflow during table alloc

* commit '86543654':
  SampleTable: check integer overflow during table alloc
parents f0d8468d 86543654

media/libstagefright/SampleTable.cpp

+14 −0
Original line number Original line Diff line number Diff line
@@ -330,6 +330,10 @@ status_t SampleTable::setTimeToSampleParams( 
    }

    }





    mTimeToSampleCount = U32_AT(&header[4]);

    mTimeToSampleCount = U32_AT(&header[4]);

    uint64_t allocSize = mTimeToSampleCount * 2 * sizeof(uint32_t);

    if (allocSize > SIZE_MAX) {

        return ERROR_OUT_OF_RANGE;

    }

    mTimeToSample = new uint32_t[mTimeToSampleCount * 2];

    mTimeToSample = new uint32_t[mTimeToSampleCount * 2];





    size_t size = sizeof(uint32_t) * mTimeToSampleCount * 2;

    size_t size = sizeof(uint32_t) * mTimeToSampleCount * 2;
@@ -372,6 +376,11 @@ status_t SampleTable::setCompositionTimeToSampleParams( 
    }

    }





    mNumCompositionTimeDeltaEntries = numEntries;

    mNumCompositionTimeDeltaEntries = numEntries;

    uint64_t allocSize = numEntries * 2 * sizeof(uint32_t);

    if (allocSize > SIZE_MAX) {

        return ERROR_OUT_OF_RANGE;

    }



    mCompositionTimeDeltaEntries = new uint32_t[2 * numEntries];

    mCompositionTimeDeltaEntries = new uint32_t[2 * numEntries];





    if (mDataSource->readAt(

    if (mDataSource->readAt(
@@ -417,6 +426,11 @@ status_t SampleTable::setSyncSampleParams(off64_t data_offset, size_t data_size) 
        ALOGV("Table of sync samples is empty or has only a single entry!");

        ALOGV("Table of sync samples is empty or has only a single entry!");

    }

    }





    uint64_t allocSize = mNumSyncSamples * sizeof(uint32_t);

    if (allocSize > SIZE_MAX) {

        return ERROR_OUT_OF_RANGE;

    }



    mSyncSamples = new uint32_t[mNumSyncSamples];

    mSyncSamples = new uint32_t[mNumSyncSamples];

    size_t size = mNumSyncSamples * sizeof(uint32_t);

    size_t size = mNumSyncSamples * sizeof(uint32_t);

    if (mDataSource->readAt(mSyncSampleOffset + 8, mSyncSamples, size)

    if (mDataSource->readAt(mSyncSampleOffset + 8, mSyncSamples, size)