Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cba0459b authored by Marco Nelissen's avatar Marco Nelissen Committed by android-build-merger
Browse files

Limit ogg packet size am: bf928560 am: f349435f am: 086cee9d am:... 

Limit ogg packet size am: bf928560 am: f349435f am: 086cee9d am: b65b0a83 am: 412be4b7 am: 045c64fe am: fd7cba4d am: 433dacf8 am: 8c805395 am: bf913622 am: d68e4e45 am: 90f3fe5f am: 08d9bb8c am: 398fa51c am: a6a7b149
am: 3d18bc31

Change-Id: Iad08c082423ee62f6088a6574053f284810d6b22
parents 5d183a92 3d18bc31

media/libstagefright/OggExtractor.cpp

+15 −1
Original line number Diff line number Diff line
@@ -697,7 +697,21 @@ status_t MyOggExtractor::_readNextPacket(MediaBuffer **out, bool calcVorbisTimes 
            if (buffer != NULL) {

                fullSize += buffer->range_length();

            }

            MediaBuffer *tmp = new MediaBuffer(fullSize);

            if (fullSize > 16 * 1024 * 1024) { // arbitrary limit of 16 MB packet size

                if (buffer != NULL) {

                    buffer->release();

                }

                ALOGE("b/36592202");

                return ERROR_MALFORMED;

            }

            MediaBuffer *tmp = new (std::nothrow) MediaBuffer(fullSize);

            if (tmp == NULL) {

                if (buffer != NULL) {

                    buffer->release();

                }

                ALOGE("b/36592202");

                return ERROR_MALFORMED;

            }

            if (buffer != NULL) {

                memcpy(tmp->data(), buffer->data(), buffer->range_length());

                tmp->set_range(0, buffer->range_length());