Merge "MPEG4Extractor: check size for yrrc box" into lmp-dev (d971d188) · Commits · e / os / android_frameworks_av

media/libstagefright/MPEG4Extractor.cpp

+9 −0

Original line number	Original line	Diff line number	Diff line
	@@ -2597,6 +2597,13 @@ status_t MPEG4Extractor::parse3GPPMetaData(off64_t offset, size_t size, int dept
	}		}
	case FOURCC('y', 'r', 'r', 'c'):		case FOURCC('y', 'r', 'r', 'c'):
	{		{
			if (size < 6) {
			delete[] buffer;
			buffer = NULL;
			ALOGE("b/62133227");
			android_errorWriteLog(0x534e4554, "62133227");
			return ERROR_MALFORMED;
			}
	char tmp[5];		char tmp[5];
	uint16_t year = U16_AT(&buffer[4]);		uint16_t year = U16_AT(&buffer[4]);

	@@ -2619,6 +2626,8 @@ status_t MPEG4Extractor::parse3GPPMetaData(off64_t offset, size_t size, int dept

	// smallest possible valid UTF-16 string w BOM: 0xfe 0xff 0x00 0x00		// smallest possible valid UTF-16 string w BOM: 0xfe 0xff 0x00 0x00
	if (size < 6) {		if (size < 6) {
			delete[] buffer;
			buffer = NULL;
	return ERROR_MALFORMED;		return ERROR_MALFORMED;
	}		}