commit 9d288727bda47c43d5f5af84b867655ba891cbc4
author ybai <ybai@dolby.com> Wed Feb 26 09:01:57 2020 +0800
committer ybai <ybai@dolby.com> Wed Feb 26 09:20:07 2020 +0800
tree ce995de5efa6ae545e1cfdc2c6142e03dd5ef0fb
parent e7f94032f622f5c964ccc3832d4087d0fd15f0da

Crash by invalid ac4 field of mp4 file in fuzzy test

Test: crash occurs in fuzzy test.

Change-Id: I8b69c11ea7a4f3573cf19ad85f85bddb44565659

media/extractors/mp4/AC4Parser.cpp

diff --git a/media/extractors/mp4/AC4Parser.cpp b/media/extractors/mp4/AC4Parser.cpp
index 13d60c8..25fc4cd 100644
--- a/media/extractors/mp4/AC4Parser.cpp
+++ b/media/extractors/mp4/AC4Parser.cpp
@@ -600,6 +600,10 @@
         if (ac4_dsi_version == 1) {
             uint64_t end = (mDSISize - mBitReader.numBitsLeft()) / 8;
             uint64_t presentation_bytes = end - start;
+            if (pres_bytes < presentation_bytes) {
+                ALOGE("pres_bytes is smaller than presentation_bytes.");
+                return false;
+            }
             uint64_t skip_bytes = pres_bytes - presentation_bytes;
             ALOGV("skipping = %" PRIu64 " bytes", skip_bytes);
             CHECK_BITS_LEFT(skip_bytes * 8);