Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit fa7a5484 authored by Joshua J. Drake's avatar Joshua J. Drake Committed by Abhisek Devkota
Browse files

Fix integer overflow when handling MPEG4 tx3g atom

When the sum of the 'size' and 'chunk_size' variables is larger than 2^32,
an integer overflow occurs. Using the result value to allocate memory
leads to an undersized buffer allocation and later a potentially
exploitable heap corruption condition. Ensure that integer overflow does
not occur.

Bug: 20923261
(cherry picked from commit 9f65a14d)

Change-Id: I81c8b074cb7f90d395d00a5c73b23f3f6c9341aa
parent 69953bc3
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment