Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8a2dd589 authored by Jon Larimer's avatar Jon Larimer Committed by Gerrit Code Review
Browse files

Merge "Fix integer overflow when handling MPEG4 tx3g atom"

parents 2be55471 f6dda8df

media/libstagefright/MPEG4Extractor.cpp

+4 −0
Original line number Diff line number Diff line
@@ -1897,6 +1897,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { 
                size = 0;

            }



            if (SIZE_MAX - chunk_size <= size) {

                return ERROR_MALFORMED;

            }



            uint8_t *buffer = new (std::nothrow) uint8_t[size + chunk_size];

            if (buffer == NULL) {

                return ERROR_MALFORMED;