commit 7a282fb64fef25349e9d341f102d9cea3bf75baf
author Marco Nelissen <marcone@google.com> Tue Feb 23 14:48:46 2016 -0800
committer The Android Automerger <android-build@google.com> Fri Feb 26 14:33:31 2016 -0800
tree 25f6a80e2e838fd5440f19187fca3ef3d8353f84
parent 1171e7c047bf79e7c93342bb6a812c9edd86aa84

Also fix out of bounds access for normal read

Previous fix accidentally only fixed the fragmented read case.

Bug: 27208621
Change-Id: Ie16f1920b84c8aba613842659238fcd5925694ad

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 6fcc095..f84dfdf 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -3977,7 +3977,15 @@
                     continue;
                 }
 
-                CHECK(dstOffset + 4 <= mBuffer->size());
+                if (dstOffset > SIZE_MAX - 4 ||
+                        dstOffset + 4 > SIZE_MAX - nalLength ||
+                        dstOffset + 4 + nalLength > mBuffer->size()) {
+                    ALOGE("b/27208621 : %zu %zu", dstOffset, mBuffer->size());
+                    android_errorWriteLog(0x534e4554, "27208621");
+                    mBuffer->release();
+                    mBuffer = NULL;
+                    return ERROR_MALFORMED;
+                }
 
                 dstData[dstOffset++] = 0;
                 dstData[dstOffset++] = 0;