Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 800e479f authored by Jon Larimer's avatar Jon Larimer Committed by Gerrit Code Review
Browse files

Merge "Prevent integer overflow when processing covr MPEG4 atoms"

parents 8a2dd589 9ad03116

media/libstagefright/MPEG4Extractor.cpp

+5 −1
Original line number Diff line number Diff line
@@ -1935,7 +1935,11 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { 


            if (mFileMetaData != NULL) {

                ALOGV("chunk_data_size = %lld and data_offset = %lld",

                        chunk_data_size, data_offset);

                        (long long)chunk_data_size, (long long)data_offset);



                if (chunk_data_size >= SIZE_MAX - 1) {

                    return ERROR_MALFORMED;

                }

                sp<ABuffer> buffer = new ABuffer(chunk_data_size + 1);

                if (mDataSource->readAt(

                    data_offset, buffer->data(), chunk_data_size) != (ssize_t)chunk_data_size) {