Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a8ac8f61 authored by Marco Nelissen's avatar Marco Nelissen Committed by android-build-merger
Browse files

Fix out-of-bounds write am: 5403587a am: fb2eb861 

am: e6bd186c

* commit 'e6bd186c':
  Fix out-of-bounds write
parents 5b7c20dd e6bd186c

media/libstagefright/MPEG4Extractor.cpp

+9 −1
Original line number Diff line number Diff line
@@ -4294,7 +4294,15 @@ status_t MPEG4Source::fragmentedRead( 
                    continue;

                }



                CHECK(dstOffset + 4 <= mBuffer->size());

                if (dstOffset > SIZE_MAX - 4 ||

                        dstOffset + 4 > SIZE_MAX - nalLength ||

                        dstOffset + 4 + nalLength > mBuffer->size()) {

                    ALOGE("b/26365349 : %zu %zu", dstOffset, mBuffer->size());

                    android_errorWriteLog(0x534e4554, "26365349");

                    mBuffer->release();

                    mBuffer = NULL;

                    return ERROR_MALFORMED;

                }



                dstData[dstOffset++] = 0;

                dstData[dstOffset++] = 0;