Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 781e751a authored by Venkatarama Avadhani's avatar Venkatarama Avadhani
Browse files

MPEG4Writer: Fix unsigned integer overflow 

When the ELST entry is added, the firstSampleOffsetTicks is subtracted
from the track header duration ticks. The subtraction could result in an
overflow if track header duration is lesser than the first sample
offset.

Bug: 345356376
Test: mpeg4_writer_fuzzer
Change-Id: Ia5bbcf3df301092bf892927e54972ee716af93f9
parent 4f195983

media/libstagefright/MPEG4Writer.cpp

+9 −2
Original line number Diff line number Diff line
@@ -4886,8 +4886,15 @@ void MPEG4Writer::Track::writeEdtsBox() { 
            int32_t mediaTime = (mFirstSampleStartOffsetUs * mTimeScale + 5E5) / 1E6;

            int32_t firstSampleOffsetTicks =

                    (mFirstSampleStartOffsetUs * mvhdTimeScale + 5E5) / 1E6;

            // samples before 0 don't count in for duration, hence subtract firstSampleOffsetTicks.

            if (tkhdDurationTicks >= firstSampleOffsetTicks) {

                // samples before 0 don't count in for duration, hence subtract

                // firstSampleOffsetTicks.

                addOneElstTableEntry(tkhdDurationTicks - firstSampleOffsetTicks, mediaTime, 1, 0);

            } else {

                ALOGW("The track header duration %" PRId64

                      " is smaller than the first sample offset %" PRId64,

                      mTrackDurationUs, mFirstSampleStartOffsetUs);

            }

        } else {

            // Track starting at zero.

            ALOGV("No edit list entry required for this track");