Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a7a63186 authored by Marco Nelissen's avatar Marco Nelissen
Browse files

Fix integer overflow abort 

Bug: 78031949
Test: manual, CTS
Change-Id: Ib528ef9fff9494b554bd02817e4176ab9f7a13a4
parent a2a19382

media/extractors/mp4/SampleIterator.cpp

+9 −1
Original line number Diff line number Diff line
@@ -328,7 +328,15 @@ status_t SampleIterator::findSampleTimeAndDuration( 
        ++mTimeToSampleIndex;

    }



    *time = mTTSSampleTime + mTTSDuration * (sampleIndex - mTTSSampleIndex);

    // below is equivalent to:

    // *time = mTTSSampleTime + mTTSDuration * (sampleIndex - mTTSSampleIndex);

    uint32_t tmp;

    if (__builtin_sub_overflow(sampleIndex, mTTSSampleIndex, &tmp) ||

            __builtin_mul_overflow(mTTSDuration, tmp, &tmp) ||

            __builtin_add_overflow(mTTSSampleTime, tmp, &tmp)) {

        return ERROR_OUT_OF_RANGE;

    }

    *time = tmp;



    int32_t offset = mTable->getCompositionTimeOffset(sampleIndex);

    if ((offset < 0 && *time < (offset == INT32_MIN ?