commit 7136a52e5f397bd80afc17e2bd75b0c3295062b1
author Marco Nelissen <marcone@google.com> Tue Oct 06 15:06:48 2020 -0700
committer Anis Assi <anisassi@google.com> Thu Nov 12 11:45:02 2020 -0800
tree aa1ac8d13b2fd84db343c513b1dad27878a72a2d
parent a9aa20052b230c698b91b93b616f2e39e5f7f610

Fix memory overflow in ESQueue

Bug: 170240631
Test: poc
Change-Id: I92433cd10cba05168f42fe8552bc6a02e1f203e7
(cherry picked from commit 91fed774acc81072616a39b353ca930563de90e3)

media/libstagefright/mpeg2ts/ESQueue.cpp

diff --git a/media/libstagefright/mpeg2ts/ESQueue.cpp b/media/libstagefright/mpeg2ts/ESQueue.cpp
index 11f3ed1..25fd529 100644
--- a/media/libstagefright/mpeg2ts/ESQueue.cpp
+++ b/media/libstagefright/mpeg2ts/ESQueue.cpp
@@ -1119,7 +1119,13 @@
                 if (mSampleDecryptor != NULL && (nalType == 1 || nalType == 5)) {
                     uint8_t *nalData = mBuffer->data() + pos.nalOffset;
                     size_t newSize = mSampleDecryptor->processNal(nalData, pos.nalSize);
-                    // Note: the data can shrink due to unescaping
+                    // Note: the data can shrink due to unescaping, but it can never grow
+                    if (newSize > pos.nalSize) {
+                        // don't log unless verbose, since this can get called a lot if
+                        // the caller is trying to resynchronize
+                        ALOGV("expected sample size < %u, got %zu", pos.nalSize, newSize);
+                        return NULL;
+                    }
                     memcpy(accessUnit->data() + dstOffset + 4,
                             nalData,
                             newSize);