Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 832fcce0 authored by TreeHugger Robot's avatar TreeHugger Robot Committed by Android (Google) Code Review
Browse files

Merge "stagefright: MPEG4Writer: fix Integer overflow"

parents 622761ea 0d3d9531
Loading
Loading
Loading
Loading
+10 −2
Original line number Diff line number Diff line
@@ -3669,11 +3669,19 @@ void MPEG4Writer::Track::writeCttsBox() {

    mOwner->beginBox("ctts");
    mOwner->writeInt32(0);  // version=0, flags=0
    uint32_t delta = mMinCttsOffsetTimeUs - getStartTimeOffsetScaledTime();
    int64_t delta = mMinCttsOffsetTimeUs - getStartTimeOffsetScaledTime();
    mCttsTableEntries->adjustEntries([delta](size_t /* ix */, uint32_t (&value)[2]) {
        // entries are <count, ctts> pairs; adjust only ctts
        uint32_t duration = htonl(value[1]); // back to host byte order
        value[1] = htonl(duration - delta);
        // Prevent overflow and underflow
        if (delta > duration) {
            duration = 0;
        } else if (delta < 0 && UINT32_MAX + delta < duration) {
            duration = UINT32_MAX;
        } else {
            duration -= delta;
        }
        value[1] = htonl(duration);
    });
    mCttsTableEntries->write(mOwner);
    mOwner->endBox();  // ctts