Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit e1be03f4 authored by Joshua J. Drake's avatar Joshua J. Drake Committed by Abhisek Devkota
Browse files

Prevent integer overflow when processing covr MPEG4 atoms

If the 'chunk_data_size' value is SIZE_MAX, an integer overflow will occur
and cause an undersized buffer to be allocated. The following processing
then overfills the resulting memory and creates a potentially exploitable
condition. Ensure that integer overflow does not occur.

Bug: 20923261
(cherry picked from commit b5738ab0)

Conflicts:
	media/libstagefright/MPEG4Extractor.cpp

Change-Id: Id7fbe1f8543cd016cf5b272b7ea4cd1fb01f2b8f
parent 69efdb17
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment