Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bab26695 authored by Marco Nelissen's avatar Marco Nelissen Committed by Vasyl Gello
Browse files

Fix potential overflow in WAV extractor 

Bug: 170583712
Test: fuzzer poc, atest DecoderTest#testDecodeWav
Change-Id: I73edd5fc0da80dc2cdd26c6fcd09496b2c828ba9
Merged-In: I73edd5fc0da80dc2cdd26c6fcd09496b2c828ba9
(cherry picked from commit d3d872da)
parent 9d3a53d7

media/libstagefright/WAVExtractor.cpp

+9 −9
Original line number Diff line number Diff line
@@ -61,7 +61,7 @@ struct WAVSource : public MediaSource { 
            const sp<DataSource> &dataSource,

            const sp<MetaData> &meta,

            uint16_t waveFormat,

            int32_t bitsPerSample,

            uint32_t bitsPerSample,

            off64_t offset, size_t size);



    virtual status_t start(MetaData *params = NULL);
@@ -82,9 +82,9 @@ private: 
    sp<DataSource> mDataSource;

    sp<MetaData> mMeta;

    uint16_t mWaveFormat;

    int32_t mSampleRate;

    int32_t mNumChannels;

    int32_t mBitsPerSample;

    uint32_t mSampleRate;

    uint32_t mNumChannels;

    uint32_t mBitsPerSample;

    off64_t mOffset;

    size_t mSize;

    bool mStarted;
@@ -357,7 +357,7 @@ WAVSource::WAVSource( 
        const sp<DataSource> &dataSource,

        const sp<MetaData> &meta,

        uint16_t waveFormat,

        int32_t bitsPerSample,

        uint32_t bitsPerSample,

        off64_t offset, size_t size)

    : mDataSource(dataSource),

      mMeta(meta),
@@ -369,8 +369,8 @@ WAVSource::WAVSource( 
      mSize(size),

      mStarted(false),

      mGroup(NULL) {

    CHECK(mMeta->findInt32(kKeySampleRate, &mSampleRate));

    CHECK(mMeta->findInt32(kKeyChannelCount, &mNumChannels));

    CHECK(mMeta->findInt32(kKeySampleRate, (int32_t*) &mSampleRate));

    CHECK(mMeta->findInt32(kKeyChannelCount, (int32_t*) &mNumChannels));



    mMeta->setInt32(kKeyMaxInputSize, kMaxFrameSize);

}
@@ -461,8 +461,8 @@ status_t WAVSource::read( 
    ALOGV("%s mBitsPerSample %d, kMaxFrameSize %zu, ",

          __func__, mBitsPerSample, kMaxFrameSize);



    size_t maxBytesAvailable =

        (mCurrentPos - mOffset >= (off64_t)mSize)

    const size_t maxBytesAvailable =

        (mCurrentPos < mOffset || mCurrentPos - mOffset >= (off64_t)mSize)

            ? 0 : mSize - (mCurrentPos - mOffset);



    if (maxBytesToRead > maxBytesAvailable) {