Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ae87c002 authored by Marco Nelissen's avatar Marco Nelissen Committed by Michael Bestas
Browse files

Fix out-of-bounds write 

Bug: 26365349
Change-Id: Ia363d9f8c231cf255dea852e0bbf5ca466c7990b
(cherry picked from commit 5403587a)
parent d43d4cbe

media/libstagefright/MPEG4Extractor.cpp

+9 −1
Original line number Diff line number Diff line
@@ -3816,7 +3816,15 @@ status_t MPEG4Source::fragmentedRead( 
                    continue;

                }



                CHECK(dstOffset + 4 <= mBuffer->size());

                if (dstOffset > SIZE_MAX - 4 ||

                        dstOffset + 4 > SIZE_MAX - nalLength ||

                        dstOffset + 4 + nalLength > mBuffer->size()) {

                    ALOGE("b/26365349 : %zu %zu", dstOffset, mBuffer->size());

                    android_errorWriteLog(0x534e4554, "26365349");

                    mBuffer->release();

                    mBuffer = NULL;

                    return ERROR_MALFORMED;

                }



                dstData[dstOffset++] = 0;

                dstData[dstOffset++] = 0;