Loading media/libstagefright/MPEG4Extractor.cpp +19 −1 Original line number Diff line number Diff line Loading @@ -44,6 +44,10 @@ #include <byteswap.h> #include "include/ID3.h" #ifndef UINT32_MAX #define UINT32_MAX (4294967295U) #endif namespace android { class MPEG4Source : public MediaSource { Loading Loading @@ -3335,13 +3339,27 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets( return ERROR_IO; } offset += 4; if (entrycount == 0) { return OK; } if (entrycount > UINT32_MAX / 8) { return ERROR_MALFORMED; } if (entrycount > mCurrentSampleInfoOffsetsAllocSize) { mCurrentSampleInfoOffsets = (uint64_t*) realloc(mCurrentSampleInfoOffsets, entrycount * 8); uint64_t *newPtr = (uint64_t *)realloc(mCurrentSampleInfoOffsets, entrycount * 8); if (newPtr == NULL) { return NO_MEMORY; } mCurrentSampleInfoOffsets = newPtr; mCurrentSampleInfoOffsetsAllocSize = entrycount; } mCurrentSampleInfoOffsetCount = entrycount; if (mCurrentSampleInfoOffsets == NULL) { return OK; } for (size_t i = 0; i < entrycount; i++) { if (version == 0) { uint32_t tmp; Loading Loading
media/libstagefright/MPEG4Extractor.cpp +19 −1 Original line number Diff line number Diff line Loading @@ -44,6 +44,10 @@ #include <byteswap.h> #include "include/ID3.h" #ifndef UINT32_MAX #define UINT32_MAX (4294967295U) #endif namespace android { class MPEG4Source : public MediaSource { Loading Loading @@ -3335,13 +3339,27 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets( return ERROR_IO; } offset += 4; if (entrycount == 0) { return OK; } if (entrycount > UINT32_MAX / 8) { return ERROR_MALFORMED; } if (entrycount > mCurrentSampleInfoOffsetsAllocSize) { mCurrentSampleInfoOffsets = (uint64_t*) realloc(mCurrentSampleInfoOffsets, entrycount * 8); uint64_t *newPtr = (uint64_t *)realloc(mCurrentSampleInfoOffsets, entrycount * 8); if (newPtr == NULL) { return NO_MEMORY; } mCurrentSampleInfoOffsets = newPtr; mCurrentSampleInfoOffsetsAllocSize = entrycount; } mCurrentSampleInfoOffsetCount = entrycount; if (mCurrentSampleInfoOffsets == NULL) { return OK; } for (size_t i = 0; i < entrycount; i++) { if (version == 0) { uint32_t tmp; Loading