Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d7d50415 authored by Jeff Tinker's avatar Jeff Tinker
Browse files

Fix security vulnerability in libstagefright

bug: 28175045
Change-Id: Icee6c7eb5b761da4aa3e412fb71825508d74d38f
parent 3d6a7149
Loading
Loading
Loading
Loading
+11 −1
Original line number Diff line number Diff line
@@ -200,7 +200,17 @@ status_t DRMSource::read(MediaBuffer **buffer, const ReadOptions *options) {
                continue;
            }

            CHECK(dstOffset + 4 <= (*buffer)->size());
            if (dstOffset > SIZE_MAX - 4 ||
                dstOffset + 4 > SIZE_MAX - nalLength ||
                dstOffset + 4 + nalLength > (*buffer)->size()) {
                (*buffer)->release();
                (*buffer) = NULL;
                if (decryptedDrmBuffer.data) {
                    delete [] decryptedDrmBuffer.data;
                    decryptedDrmBuffer.data = NULL;
                }
                return ERROR_MALFORMED;
            }

            dstData[dstOffset++] = 0;
            dstData[dstOffset++] = 0;