Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9c8f6704 authored by Abhishek Arya's avatar Abhishek Arya Committed by Android Git Automerger
Browse files

am 00a5d79d: am 1bbf2488: Merge "libstagefright: fix overflow in... 

am 00a5d79d: am 1bbf2488: Merge "libstagefright: fix overflow in MPEG4Source::parseSampleAuxiliaryInformationOffsets." into mnc-dev

* commit '00a5d79d':
  libstagefright: fix overflow in MPEG4Source::parseSampleAuxiliaryInformationOffsets.
parents 1da85d68 00a5d79d

media/libstagefright/MPEG4Extractor.cpp

+15 −1
Original line number Diff line number Diff line
@@ -3584,13 +3584,27 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets( 
        return ERROR_IO;

    }

    offset += 4;

    if (entrycount == 0) {

        return OK;

    }

    if (entrycount > UINT32_MAX / 8) {

        return ERROR_MALFORMED;

    }



    if (entrycount > mCurrentSampleInfoOffsetsAllocSize) {

        mCurrentSampleInfoOffsets = (uint64_t*) realloc(mCurrentSampleInfoOffsets, entrycount * 8);

        uint64_t *newPtr = (uint64_t *)realloc(mCurrentSampleInfoOffsets, entrycount * 8);

        if (newPtr == NULL) {

            return NO_MEMORY;

        }

        mCurrentSampleInfoOffsets = newPtr;

        mCurrentSampleInfoOffsetsAllocSize = entrycount;

    }

    mCurrentSampleInfoOffsetCount = entrycount;



    if (mCurrentSampleInfoOffsets == NULL) {

        return OK;

    }



    for (size_t i = 0; i < entrycount; i++) {

        if (version == 0) {

            uint32_t tmp;