Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ed802763 authored by Bartosz Bialek's avatar Bartosz Bialek Committed by Takahiro Aizawa
Browse files

Guard against sample time overflow 

Malformed content that has unexpectedly big delta values in stts atom
might cause integer overflow on calculating sample time while preparing
sample table. This commit prevents this situation.

Test: play mp4 file with quite big 'stts' value
Bug: 35985363

Change-Id: I6bc66f77b8b99a14517e56c3ceba9ddb9bf5524d
parent 18dc831e

media/libstagefright/SampleTable.cpp

+7 −1
Original line number Diff line number Diff line
@@ -698,9 +698,15 @@ void SampleTable::buildSampleEntriesTable() { 
            }



            ++sampleIndex;

            if (sampleTime > UINT32_MAX - delta) {

                ALOGE("%u + %u would overflow, clamping",

                    sampleTime, delta);

                sampleTime = UINT32_MAX;

            } else {

                sampleTime += delta;

            }

        }

    }



    qsort(mSampleTimeEntries, mNumSampleSizes, sizeof(SampleTimeEntry),

          CompareIncreasingTime);