commit 32268b2086ed779c4aee1d09e590b3577a628ed9
author Nick Kralevich <nnk@google.com> Thu Apr 23 19:50:18 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Thu Apr 23 19:50:18 2015 +0000
tree 2e0ac23518fc3a8f680db61267126eddf0a55328
parent 41fec5413e6e939ed3275ec932a63fd235571d49
parent a05bd3c1cdff400ad92532b06d40ddc5c638c284

am a05bd3c1: am 2f47bb53: am eb204f82: am b919a3a3: am 64290793: Merge "Fix integer underflow in ESDS processing" into klp-dev

* commit 'a05bd3c1cdff400ad92532b06d40ddc5c638c284':
  Fix integer underflow in ESDS processing

media/libstagefright/ESDS.cpp

diff --git a/media/libstagefright/ESDS.cpp b/media/libstagefright/ESDS.cpp
index 427bf7b..8fbb57c 100644
--- a/media/libstagefright/ESDS.cpp
+++ b/media/libstagefright/ESDS.cpp
@@ -136,6 +136,8 @@
     --size;
 
     if (streamDependenceFlag) {
+        if (size < 2)
+            return ERROR_MALFORMED;
         offset += 2;
         size -= 2;
     }
@@ -145,11 +147,15 @@
             return ERROR_MALFORMED;
         }
         unsigned URLlength = mData[offset];
+        if (URLlength >= size)
+            return ERROR_MALFORMED;
         offset += URLlength + 1;
         size -= URLlength + 1;
     }
 
     if (OCRstreamFlag) {
+        if (size < 2)
+            return ERROR_MALFORMED;
         offset += 2;
         size -= 2;