Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e47ede5c authored by Jeff Tinker's avatar Jeff Tinker Committed by android-build-merger
Browse files

Merge "Fix security vulnerability in libstagefright" into klp-dev am:... 

Merge "Fix security vulnerability in libstagefright" into klp-dev am: eb37c37c am: 883b244f am: 31a3aa56 am: f1114192 am: 64149d75 am: 16f7ee09 am: f518e501 am: eb919fc1 am: 7e580879
am: a78d7f2d

* commit 'a78d7f2d':
  Fix security vulnerability in libstagefright

Change-Id: I12f1c1c266ae15813bcc2b132b79d0fd8ddeab5c
parents ec5e9c0f a78d7f2d

media/libstagefright/DRMExtractor.cpp

+11 −1
Original line number Diff line number Diff line
@@ -200,7 +200,17 @@ status_t DRMSource::read(MediaBuffer **buffer, const ReadOptions *options) { 
                continue;

            }



            CHECK(dstOffset + 4 <= (*buffer)->size());

            if (dstOffset > SIZE_MAX - 4 ||

                dstOffset + 4 > SIZE_MAX - nalLength ||

                dstOffset + 4 + nalLength > (*buffer)->size()) {

                (*buffer)->release();

                (*buffer) = NULL;

                if (decryptedDrmBuffer.data) {

                    delete [] decryptedDrmBuffer.data;

                    decryptedDrmBuffer.data = NULL;

                }

                return ERROR_MALFORMED;

            }



            dstData[dstOffset++] = 0;

            dstData[dstOffset++] = 0;