commit e7a1e1a0339acc97237f2725d31b8ef77629c978
author Robert Shih <robertshih@google.com> Thu May 30 19:07:47 2019 -0700
committer Nikoli Cartagena <dargeren@google.com> Mon Jun 10 13:30:19 2019 -0700
tree 13ac206826f6b1010d0c90df0b830fc98d39e85d
parent fde3f49b53148a3e47fcd1340534a6b5dc818e2a

httplive: detect oom if playlist is infinite

Bug: 68399439
Test: StagefrightTest#testStagefright_cve_2017_13279
Change-Id: Icf39c2ae58d9d6ba7c74bbcfbe2154e66e6c9e40
(cherry picked from commit f3808d3a2e8c646d5edad451a80daa61a4e5d836)

media/libstagefright/httplive/HTTPDownloader.cpp

diff --git a/media/libstagefright/httplive/HTTPDownloader.cpp b/media/libstagefright/httplive/HTTPDownloader.cpp
index 793695a..9d40d3e 100644
--- a/media/libstagefright/httplive/HTTPDownloader.cpp
+++ b/media/libstagefright/httplive/HTTPDownloader.cpp
@@ -157,6 +157,12 @@
                  buffer->size() + bufferRemaining);
 
             sp<ABuffer> copy = new ABuffer(buffer->size() + bufferRemaining);
+            if (copy->data() == NULL) {
+                android_errorWriteLog(0x534e4554, "68399439");
+                ALOGE("not enough memory to download: requesting %zu + %zu",
+                        buffer->size(), bufferRemaining);
+                return NO_MEMORY;
+            }
             memcpy(copy->data(), buffer->data(), buffer->size());
             copy->setRange(0, buffer->size());