am 4dd7cb69: Fix integer underflow in ESDS processing (8ef5da3d) · Commits · e / os / android_frameworks_av

media/libstagefright/ESDS.cpp

+6 −0

Original line number	Original line	Diff line number	Diff line
	@@ -136,6 +136,8 @@ status_t ESDS::parseESDescriptor(size_t offset, size_t size) {
	--size;		--size;

	if (streamDependenceFlag) {		if (streamDependenceFlag) {
			if (size < 2)
			return ERROR_MALFORMED;
	offset += 2;		offset += 2;
	size -= 2;		size -= 2;
	}		}
	@@ -145,11 +147,15 @@ status_t ESDS::parseESDescriptor(size_t offset, size_t size) {
	return ERROR_MALFORMED;		return ERROR_MALFORMED;
	}		}
	unsigned URLlength = mData[offset];		unsigned URLlength = mData[offset];
			if (URLlength >= size)
			return ERROR_MALFORMED;
	offset += URLlength + 1;		offset += URLlength + 1;
	size -= URLlength + 1;		size -= URLlength + 1;
	}		}

	if (OCRstreamFlag) {		if (OCRstreamFlag) {
			if (size < 2)
			return ERROR_MALFORMED;
	offset += 2;		offset += 2;
	size -= 2;		size -= 2;