Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ce73af07 authored by Marco Nelissen's avatar Marco Nelissen
Browse files

DO NOT MERGE Fail more gracefully on allocation failure 

Check allocations when the size is read from a file and might therefore
be invalid.

b/14388161

Change-Id: Ia08cc0a6107f275a70e793ef3b50c0ce16ceeee0
parent aa8dab77

media/libstagefright/MPEG4Extractor.cpp

+16 −6
Original line number Diff line number Diff line
@@ -286,7 +286,7 @@ MPEG4Extractor::~MPEG4Extractor() { 
    SINF *sinf = mFirstSINF;

    while (sinf) {

        SINF *next = sinf->next;

        delete sinf->IPMPData;

        delete[] sinf->IPMPData;

        delete sinf;

        sinf = next;

    }
@@ -539,7 +539,11 @@ status_t MPEG4Extractor::parseDrmSINF(off64_t *offset, off64_t data_offset) { 
                return ERROR_MALFORMED;

            }

            sinf->len = dataLen - 3;

            sinf->IPMPData = new char[sinf->len];

            sinf->IPMPData = new (std::nothrow) char[sinf->len];

            if (sinf->IPMPData == NULL) {

                return ERROR_MALFORMED;

            }

            data_offset += 2;



            if (mDataSource->readAt(data_offset + 2, sinf->IPMPData, sinf->len) < sinf->len) {

                return ERROR_IO;
@@ -1400,8 +1404,7 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { 
            if ((chunk_size > SIZE_MAX) || (SIZE_MAX - chunk_size <= size)) {

                return ERROR_MALFORMED;

            }



            uint8_t *buffer = new uint8_t[size + chunk_size];

            uint8_t *buffer = new (std::nothrow) uint8_t[size + chunk_size];

            if (buffer == NULL) {

                return ERROR_MALFORMED;

            }
@@ -1570,7 +1573,10 @@ status_t MPEG4Extractor::parseMetaData(off64_t offset, size_t size) { 
        return ERROR_MALFORMED;

    }



    uint8_t *buffer = new uint8_t[size + 1];

    uint8_t *buffer = new (std::nothrow) uint8_t[size + 1];

    if (buffer == NULL) {

        return ERROR_MALFORMED;

    }

    if (mDataSource->readAt(

                offset, buffer, size) != (ssize_t)size) {

        delete[] buffer;
@@ -1964,7 +1970,11 @@ status_t MPEG4Source::start(MetaData *params) { 


    mGroup->add_buffer(new MediaBuffer(max_size));



    mSrcBuffer = new uint8_t[max_size];

    mSrcBuffer = new (std::nothrow) uint8_t[max_size];

    if (mSrcBuffer == NULL) {

        // file probably specified a bad max size

        return ERROR_MALFORMED;

    }



    mStarted = true;