Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e95676ac authored by Ian Baker's avatar Ian Baker Committed by Android (Google) Code Review
Browse files

Merge changes from topic "presubmit-am-86952eef04b84521b2737a67f64c1d45" 

* changes:
  Fix Unsigned-integer-overflow in MPEG4Extractor 2p: b83c4389
  Fix Unsigned-integer-overflow in MPEG4Extractor
parents 9f011df1 22385646

media/module/extractors/mp4/MPEG4Extractor.cpp

+15 −4
Original line number Diff line number Diff line
@@ -5908,12 +5908,18 @@ status_t MPEG4Source::parseTrackFragmentRun(off64_t offset, off64_t size) { 
            return -EINVAL;

        }



        int32_t dataOffsetDelta;

        if (!mDataSource->getUInt32(offset, (uint32_t*)&dataOffsetDelta)) {

        uint32_t dataOffsetDelta;

        if (!mDataSource->getUInt32(offset, &dataOffsetDelta)) {

            return ERROR_MALFORMED;

        }



        dataOffset = mTrackFragmentHeaderInfo.mBaseDataOffset + dataOffsetDelta;

        if (__builtin_add_overflow(

                mTrackFragmentHeaderInfo.mBaseDataOffset, dataOffsetDelta, &dataOffset)) {

            ALOGW("b/232242894 mBaseDataOffset(%" PRIu64 ") + dataOffsetDelta(%u) overflows uint64",

                    mTrackFragmentHeaderInfo.mBaseDataOffset, dataOffsetDelta);

            android_errorWriteLog(0x534e4554, "232242894");

            return ERROR_MALFORMED;

        }



        offset += 4;

        size -= 4;
@@ -6047,7 +6053,12 @@ status_t MPEG4Source::parseTrackFragmentRun(off64_t offset, off64_t size) { 
            return NO_MEMORY;

        }



        dataOffset += sampleSize;

        if (__builtin_add_overflow(dataOffset, sampleSize, &dataOffset)) {

            ALOGW("b/232242894 dataOffset(%" PRIu64 ") + sampleSize(%u) overflows uint64",

                    dataOffset, sampleSize);

            android_errorWriteLog(0x534e4554, "232242894");

            return ERROR_MALFORMED;

        }

    }



    mTrackFragmentHeaderInfo.mDataOffset = dataOffset;