Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c74c5299 authored by Marco Nelissen's avatar Marco Nelissen Committed by Jessica Wagantall
Browse files

Check NAL size before use 

Ticket: CYNGNOS-1299
Bug: 24441553
Bug: 24445122
Change-Id: Ib7f025769adbafd5a2cb64fae5562a0a565945c2
(cherry picked from commit 5d101298)
parent c4dde20c

media/libstagefright/MPEG4Extractor.cpp

+9 −2
Original line number Diff line number Diff line
@@ -4214,7 +4214,10 @@ status_t MPEG4Source::read( 
            (const uint8_t *)mBuffer->data() + mBuffer->range_offset();



        size_t nal_size = parseNALSize(src);

        if (mBuffer->range_length() < mNALLengthSize + nal_size) {

        if (mNALLengthSize > SIZE_MAX - nal_size) {

            ALOGE("b/24441553, b/24445122");

        }

        if (mBuffer->range_length() - mNALLengthSize < nal_size) {

            ALOGE("incomplete NAL unit.");



            mBuffer->release();
@@ -4501,7 +4504,11 @@ status_t MPEG4Source::fragmentedRead( 
            (const uint8_t *)mBuffer->data() + mBuffer->range_offset();



        size_t nal_size = parseNALSize(src);

        if (mBuffer->range_length() < mNALLengthSize + nal_size) {

        if (mNALLengthSize > SIZE_MAX - nal_size) {

            ALOGE("b/24441553, b/24445122");

        }



        if (mBuffer->range_length() - mNALLengthSize < nal_size) {

            ALOGE("incomplete NAL unit.");



            mBuffer->release();