Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c580c836 authored by Joshua J. Drake's avatar Joshua J. Drake Committed by Robert Shih
Browse files

Prevent integer issues in ID3::Iterator::findFrame 

Integer overflows could occur a few places within findFrame. These can lead to
out-of-bounds reads and potentially infinite loops. Ensure that arithmetic does
not wrap around to prevent these behaviors.

Bug: 23285192
Change-Id: I72a61df7d5719d1d3f2bd0b37fba86f0f4bbedee
parent 916a9684

media/libstagefright/id3/ID3.cpp

+21 −2
Original line number Diff line number Diff line
@@ -659,6 +659,11 @@ void ID3::Iterator::findFrame() { 


            mFrameSize += 6;



            // Prevent integer overflow in validation

            if (SIZE_MAX - mOffset <= mFrameSize) {

                return;

            }



            if (mOffset + mFrameSize > mParent.mSize) {

                ALOGV("partial frame at offset %d (size = %d, bytes-remaining = %d)",

                     mOffset, mFrameSize, mParent.mSize - mOffset - 6);
@@ -688,7 +693,7 @@ void ID3::Iterator::findFrame() { 
                return;

            }



            size_t baseSize;

            size_t baseSize = 0;

            if (mParent.mVersion == ID3_V2_4) {

                if (!ParseSyncsafeInteger(

                            &mParent.mData[mOffset + 4], &baseSize)) {
@@ -698,7 +703,21 @@ void ID3::Iterator::findFrame() { 
                baseSize = U32_AT(&mParent.mData[mOffset + 4]);

            }



            mFrameSize = 10 + baseSize;

            if (baseSize == 0) {

                return;

            }



            // Prevent integer overflow when adding

            if (SIZE_MAX - 10 <= baseSize) {

                return;

            }



            mFrameSize = 10 + baseSize; // add tag id, size field and flags



            // Prevent integer overflow in validation

            if (SIZE_MAX - mOffset <= mFrameSize) {

                return;

            }



            if (mOffset + mFrameSize > mParent.mSize) {

                ALOGV("partial frame at offset %d (size = %d, bytes-remaining = %d)",