Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f349435f authored by Marco Nelissen's avatar Marco Nelissen Committed by android-build-merger
Browse files

Limit ogg packet size

am: bf928560

Change-Id: I102f6e9b1b4933d043b2a3e1e3f7fc885aaf6779
parents 0893c50b bf928560
Loading
Loading
Loading
Loading
+15 −1
Original line number Diff line number Diff line
@@ -481,7 +481,21 @@ status_t MyVorbisExtractor::readNextPacket(MediaBuffer **out) {
            if (buffer != NULL) {
                fullSize += buffer->range_length();
            }
            MediaBuffer *tmp = new MediaBuffer(fullSize);
            if (fullSize > 16 * 1024 * 1024) { // arbitrary limit of 16 MB packet size
                if (buffer != NULL) {
                    buffer->release();
                }
                ALOGE("b/36592202");
                return ERROR_MALFORMED;
            }
            MediaBuffer *tmp = new (std::nothrow) MediaBuffer(fullSize);
            if (tmp == NULL) {
                if (buffer != NULL) {
                    buffer->release();
                }
                ALOGE("b/36592202");
                return ERROR_MALFORMED;
            }
            if (buffer != NULL) {
                memcpy(tmp->data(), buffer->data(), buffer->range_length());
                tmp->set_range(0, buffer->range_length());