Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 88b3147e authored by Robert Shih's avatar Robert Shih
Browse files

NuPlayerStreamListener: NULL and bounds check before memcpy

Bug: 27533704
Change-Id: I992a7709b92b1cbc3114c97bec48a3fc5b22ba6e
parent 1595f8ac
Loading
Loading
Loading
Loading
+10 −1
Original line number Diff line number Diff line
@@ -144,8 +144,17 @@ ssize_t NuPlayer::NuPlayerStreamListener::read(
        copy = size;
    }

    if (entry->mIndex >= mBuffers.size()) {
        return ERROR_MALFORMED;
    }

    sp<IMemory> mem = mBuffers.editItemAt(entry->mIndex);
    if (mem == NULL || mem->size() < copy || mem->size() - copy < entry->mOffset) {
        return ERROR_MALFORMED;
    }

    memcpy(data,
           (const uint8_t *)mBuffers.editItemAt(entry->mIndex)->pointer()
           (const uint8_t *)mem->pointer()
            + entry->mOffset,
           copy);