Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 833fb390 authored by Marco Nelissen's avatar Marco Nelissen
Browse files

Fix potential overflows 

Bug: 33402896
Test: played file that triggered overflow
Change-Id: Ibf51bbbd4749377d3e77cf6e53fc66ae33b8ee7c
parent edbb04f4

media/libstagefright/SampleIterator.cpp

+10 −2
Original line number Diff line number Diff line
@@ -305,8 +305,16 @@ status_t SampleIterator::findSampleTimeAndDuration( 
        return ERROR_OUT_OF_RANGE;

    }



    while (sampleIndex >= mTTSSampleIndex + mTTSCount) {

        if (mTimeToSampleIndex == mTable->mTimeToSampleCount) {

    while (true) {

        if (mTTSSampleIndex > UINT32_MAX - mTTSCount) {

            return ERROR_OUT_OF_RANGE;

        }

        if(sampleIndex < mTTSSampleIndex + mTTSCount) {

            break;

        }

        if (mTimeToSampleIndex == mTable->mTimeToSampleCount ||

            mTTSCount > UINT32_MAX / mTTSDuration ||

            mTTSSampleTime > UINT32_MAX - (mTTSCount * mTTSDuration)) {

            return ERROR_OUT_OF_RANGE;

        }