Ogg: avoid size_t overflow in base64 decoding (d2605273) · Commits · e / os / android_frameworks_av

media/libstagefright/OggExtractor.cpp

+15 −5

Original line number	Diff line number	Diff line
		@@ -844,11 +844,14 @@ static uint8_t DecodeBase64(const char s, size_t size, size_t *outSize) {
		}
		}

		size_t outLen = 3 * size / 4 - padding;

		*outSize = outLen;
		// We divide first to avoid overflow. It's OK to do this because we
		// already made sure that size % 4 == 0.
		size_t outLen = (size / 4) * 3 - padding;

		void *buffer = malloc(outLen);
		if (buffer == NULL) {
		return NULL;
		}

		uint8_t out = (uint8_t )buffer;
		size_t j = 0;
		@@ -867,10 +870,10 @@ static uint8_t DecodeBase64(const char s, size_t size, size_t *outSize) {
		} else if (c == '/') {
		value = 63;
		} else if (c != '=') {
		return NULL;
		break;
		} else {
		if (i < n - padding) {
		return NULL;
		break;
		}

		value = 0;
		@@ -888,6 +891,13 @@ static uint8_t DecodeBase64(const char s, size_t size, size_t *outSize) {
		}
		}

		// Check if we exited the loop early.
		if (j < outLen) {
		free(buffer);
		return NULL;
		}

		*outSize = outLen;
		return (uint8_t *)buffer;
		}