Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit c0fec2d9 authored by Marco Nelissen's avatar Marco Nelissen Committed by Tim Schumacher
Browse files

Limit ogg packet size 

A malformed ogg file might lace together a very large packet, which
could lead to out of memory conditions. Limit the packet size to
avoid this.

Bug: 36592202
AOSP-Change-Id: I8650b3ec54a0de9ec302a7cbac296bb85efcfb3d
(cherry picked from commit bf928560)

Change-Id: I30a2f3341492e977387f3a642264a677118e320c
parent 08a6603c

media/libstagefright/OggExtractor.cpp

+15 −1
Original line number Diff line number Diff line
@@ -485,7 +485,21 @@ status_t MyVorbisExtractor::readNextPacket(MediaBuffer **out) { 
            if (buffer != NULL) {

                fullSize += buffer->range_length();

            }

            MediaBuffer *tmp = new MediaBuffer(fullSize);

            if (fullSize > 16 * 1024 * 1024) { // arbitrary limit of 16 MB packet size

                if (buffer != NULL) {

                    buffer->release();

                }

                ALOGE("b/36592202");

                return ERROR_MALFORMED;

            }

            MediaBuffer *tmp = new (std::nothrow) MediaBuffer(fullSize);

            if (tmp == NULL) {

                if (buffer != NULL) {

                    buffer->release();

                }

                ALOGE("b/36592202");

                return ERROR_MALFORMED;

            }

            if (buffer != NULL) {

                memcpy(tmp->data(), buffer->data(), buffer->range_length());

                tmp->set_range(0, buffer->range_length());