Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8da8b2e8 authored by Marco Nelissen's avatar Marco Nelissen
Browse files

Fail more gracefully on allocation failure 

Check allocations when the size is read from a file and might therefore
be invalid.

b/14388161

Change-Id: Ia08cc0a6107f275a70e793ef3b50c0ce16ceeee0
parent 7791cf11

media/libstagefright/MPEG4Extractor.cpp

+26 −7
Original line number Diff line number Diff line
@@ -369,7 +369,7 @@ MPEG4Extractor::~MPEG4Extractor() { 
    SINF *sinf = mFirstSINF;

    while (sinf) {

        SINF *next = sinf->next;

        delete sinf->IPMPData;

        delete[] sinf->IPMPData;

        delete sinf;

        sinf = next;

    }
@@ -694,7 +694,10 @@ status_t MPEG4Extractor::parseDrmSINF( 
                return ERROR_MALFORMED;

            }

            sinf->len = dataLen - 3;

            sinf->IPMPData = new char[sinf->len];

            sinf->IPMPData = new (std::nothrow) char[sinf->len];

            if (sinf->IPMPData == NULL) {

                return ERROR_MALFORMED;

            }

            data_offset += 2;



            if (mDataSource->readAt(data_offset, sinf->IPMPData, sinf->len) < sinf->len) {
@@ -1112,7 +1115,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { 
                return ERROR_MALFORMED;

            }



            pssh.data = new uint8_t[pssh.datalen];

            pssh.data = new (std::nothrow) uint8_t[pssh.datalen];

            if (pssh.data == NULL) {

                return ERROR_MALFORMED;

            }

            ALOGV("allocated pssh @ %p", pssh.data);

            ssize_t requested = (ssize_t) pssh.datalen;

            if (mDataSource->readAt(data_offset + 24, pssh.data, requested) < requested) {
@@ -1794,7 +1800,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { 
                size = 0;

            }



            uint8_t *buffer = new uint8_t[size + chunk_size];

            uint8_t *buffer = new (std::nothrow) uint8_t[size + chunk_size];

            if (buffer == NULL) {

                return ERROR_MALFORMED;

            }



            if (size > 0) {

                memcpy(buffer, data, size);
@@ -2111,7 +2120,10 @@ status_t MPEG4Extractor::parseITunesMetaData(off64_t offset, size_t size) { 
        return ERROR_MALFORMED;

    }



    uint8_t *buffer = new uint8_t[size + 1];

    uint8_t *buffer = new (std::nothrow) uint8_t[size + 1];

    if (buffer == NULL) {

        return ERROR_MALFORMED;

    }

    if (mDataSource->readAt(

                offset, buffer, size) != (ssize_t)size) {

        delete[] buffer;
@@ -2298,7 +2310,10 @@ status_t MPEG4Extractor::parse3GPPMetaData(off64_t offset, size_t size, int dept 
        return ERROR_MALFORMED;

    }



    uint8_t *buffer = new uint8_t[size];

    uint8_t *buffer = new (std::nothrow) uint8_t[size];

    if (buffer == NULL) {

        return ERROR_MALFORMED;

    }

    if (mDataSource->readAt(

                offset, buffer, size) != (ssize_t)size) {

        delete[] buffer;
@@ -2917,7 +2932,11 @@ status_t MPEG4Source::start(MetaData *params) { 


    mGroup->add_buffer(new MediaBuffer(max_size));



    mSrcBuffer = new uint8_t[max_size];

    mSrcBuffer = new (std::nothrow) uint8_t[max_size];

    if (mSrcBuffer == NULL) {

        // file probably specified a bad max size

        return ERROR_MALFORMED;

    }



    mStarted = true;