Prevent integer overflow when processing covr MPEG4 atoms
If the 'chunk_data_size' value is SIZE_MAX, an integer overflow will occur and cause an undersized buffer to be allocated. The following processing then overfills the resulting memory and creates a potentially exploitable condition. Ensure that integer overflow does not occur. Bug: 20923261 (cherry picked from commit b5738ab0) Conflicts: media/libstagefright/MPEG4Extractor.cpp Change-Id: Id7fbe1f8543cd016cf5b272b7ea4cd1fb01f2b8f
Loading
Please register or sign in to comment