commit 16c8f0ddb60293a694c39aec90aeb0a8663234ca
author shaohongsheng <shao.hongsheng@zte.com.cn> Tue Jan 09 15:52:53 2018 +0800
committer Jia Jia <jia.jia@zte.com.cn> Mon Jan 15 22:42:28 2018 +0000
tree 439657a691b35538d8a5ad126259cca5d55c91c2
parent 18977849c84ed47252e73b06c6122753fb5ab699

SampleIterator: fix sizeof bug in getSampleSizeDirect.

Incorrect sizeof(*size) in SampleIterator::getSampleSizeDirect
potentially leads to file size overflow.

Test: Create m4a file with stsz box in the end of file and play it.

Change-Id: Ic8a073de2dfc35890ce65a03dd5ed9343a6ff007

Signed-off-by: Jia Jia <jia.jia@zte.com.cn>

media/libstagefright/SampleIterator.cpp

diff --git a/media/libstagefright/SampleIterator.cpp b/media/libstagefright/SampleIterator.cpp
index 75f744d..7a51027 100644
--- a/media/libstagefright/SampleIterator.cpp
+++ b/media/libstagefright/SampleIterator.cpp
@@ -244,13 +244,14 @@
     switch (mTable->mSampleSizeFieldSize) {
         case 32:
         {
+            uint32_t x;
             if (mTable->mDataSource->readAt(
                         mTable->mSampleSizeOffset + 12 + 4 * sampleIndex,
-                        size, sizeof(*size)) < (ssize_t)sizeof(*size)) {
+                        &x, sizeof(x)) < (ssize_t)sizeof(x)) {
                 return ERROR_IO;
             }
 
-            *size = ntohl(*size);
+            *size = ntohl(x);
             break;
         }