Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8afc3e16 authored by Treehugger Robot's avatar Treehugger Robot Committed by Automerger Merge Worker
Browse files

Merge "Bounds check exposed by fuzzer" am: a60bf718 am: 5252e843 

Original change: https://android-review.googlesource.com/c/platform/frameworks/av/+/2582927



Change-Id: Ica38d8286711888e87bb0fc53a6c90e86e225f3b
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 3e21e14b 5252e843

media/module/extractors/mp3/VBRISeeker.cpp

+5 −5
Original line number Diff line number Diff line
@@ -84,7 +84,9 @@ VBRISeeker *VBRISeeker::CreateFromSource( 
         scale,

         entrySize);



    if (entrySize > 4) {

    // RBE check on the small end too

    // b/280693435, which is duped to b/155563985

    if (entrySize < 1 || entrySize > 4) {

        ALOGE("invalid VBRI entry size: %zu", entrySize);

        return NULL;

    }
@@ -123,15 +125,13 @@ VBRISeeker *VBRISeeker::CreateFromSource( 
    off64_t offset = post_id3_pos;

    for (size_t i = 0; i < numEntries; ++i) {

        uint32_t numBytes;

        // entrySize is known to be [1..4]

        switch (entrySize) {

            case 1: numBytes = buffer[i]; break;

            case 2: numBytes = U16_AT(buffer + 2 * i); break;

            case 3: numBytes = U24_AT(buffer + 3 * i); break;

            default:

            {

                CHECK_EQ(entrySize, 4u);

                numBytes = U32_AT(buffer + 4 * i); break;

            }

            case 4: numBytes = U32_AT(buffer + 4 * i); break;

        }



        numBytes *= scale;