Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fa8ebb45 authored by Jeff Tinker's avatar Jeff Tinker
Browse files

Check integer overflow to prevent memory corruption 

bug: 23016072
Change-Id: If3c9a835408773847c0024a812bd8b4915ebd680
parent 123e0f44

media/libstagefright/DRMExtractor.cpp

+2 −1
Original line number Diff line number Diff line
@@ -186,7 +186,8 @@ status_t DRMSource::read(MediaBuffer **buffer, const ReadOptions *options) { 


            srcOffset += mNALLengthSize;



            if (srcOffset + nalLength > len) {

            size_t end = srcOffset + nalLength;

            if (end > len || end < srcOffset) {

                if (decryptedDrmBuffer.data) {

                    delete [] decryptedDrmBuffer.data;

                    decryptedDrmBuffer.data = NULL;