Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cbcd8dd1 authored by Chad Brubaker's avatar Chad Brubaker
Browse files

Fix benign overflow in SampleIterator 

Bug:24807954
Change-Id: I83fe1990408c5f1da7cf46ff2a2cafb96b3e8cdd
parent 8c02c891

media/libstagefright/SampleIterator.cpp

+7 −0
Original line number Diff line number Diff line
@@ -166,6 +166,13 @@ status_t SampleIterator::findChunkRange(uint32_t sampleIndex) { 
        if (mSampleToChunkIndex + 1 < mTable->mNumSampleToChunkOffsets) {

            mStopChunk = entry[1].startChunk;



            if (mStopChunk < mFirstChunk ||

                (mStopChunk - mFirstChunk) > UINT32_MAX / mSamplesPerChunk ||

                ((mStopChunk - mFirstChunk) * mSamplesPerChunk >

                 UINT32_MAX - mFirstChunkSampleIndex)) {



                return ERROR_OUT_OF_RANGE;

            }

            mStopChunkSampleIndex =

                mFirstChunkSampleIndex

                    + (mStopChunk - mFirstChunk) * mSamplesPerChunk;