Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit df1ecfe3 authored by Joshua J. Drake's avatar Joshua J. Drake Committed by Android Git Automerger
Browse files

am 52d1defc: am 9481a101: am a81b3779: Prevent integer overflow when processing covr MPEG4 atoms 

* commit '52d1defc':
  Prevent integer overflow when processing covr MPEG4 atoms
parents b32957db 52d1defc

media/libstagefright/MPEG4Extractor.cpp

+3 −0
Original line number Diff line number Diff line
@@ -1426,6 +1426,9 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { 
            if (mFileMetaData != NULL) {

                ALOGV("chunk_data_size = %lld and data_offset = %lld",

                        chunk_data_size, data_offset);

                if (chunk_data_size >= SIZE_MAX - 1) {

                    return ERROR_MALFORMED;

                }

                uint8_t *buffer = new uint8_t[chunk_data_size + 1];

                if (mDataSource->readAt(

                    data_offset, buffer, chunk_data_size) != (ssize_t)chunk_data_size) {