| commit | 417a57a89cc6a49938b03e622d0e7c1021a6a4d9 | [log] [tgz] |
|---|---|---|
| author | Nick Kralevich <nnk@google.com> | Fri Aug 07 11:19:24 2015 -0700 |
| committer | The Android Automerger <android-build@google.com> | Fri Aug 14 12:24:51 2015 -0700 |
| tree | 0a096af0d180efdad344e531b75cf440be670159 | |
| parent | ac09dc56cc4f2c1daa0ea53a32811514b923182a [diff] |
MPEG4Extractor.cpp: handle chunk_size > SIZE_MAX chunk_size is a uint64_t, so it can legitimately be bigger than SIZE_MAX, which would cause the subtraction to underflow. https://code.google.com/p/android/issues/detail?id=182251 Bug: 23034759 Change-Id: Ic1637fb26bf6edb0feb1bcf2876fd370db1ed547
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index fe4527d..03d2a29 100644 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -1893,7 +1893,7 @@ size = 0; } - if (SIZE_MAX - chunk_size <= size) { + if ((chunk_size > SIZE_MAX) || (SIZE_MAX - chunk_size <= size)) { return ERROR_MALFORMED; }