commit 00f5fa82d884c0ca41ee08e7a67ab54238109083
author Marco Nelissen <marcone@google.com> Tue Oct 06 16:45:37 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Tue Oct 06 16:45:37 2015 +0000
tree 6a9e3a3858170313feea1a35924e3f6786bbab82
parent 60b25aa0c173854593743dd85588c7449baf87c0
parent 74d1927e4122a1748f89ca2ef79406fc06ee94b2

am 74d1927e: Merge "Check NAL size before use" into klp-dev

* commit '74d1927e4122a1748f89ca2ef79406fc06ee94b2':
  Check NAL size before use

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 983f64f..7284d6a 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -3495,7 +3495,10 @@
             (const uint8_t *)mBuffer->data() + mBuffer->range_offset();
 
         size_t nal_size = parseNALSize(src);
-        if (mBuffer->range_length() < mNALLengthSize + nal_size) {
+        if (mNALLengthSize > SIZE_MAX - nal_size) {
+            ALOGE("b/24441553, b/24445122");
+        }
+        if (mBuffer->range_length() - mNALLengthSize < nal_size) {
             ALOGE("incomplete NAL unit.");
 
             mBuffer->release();
@@ -3768,7 +3771,11 @@
             (const uint8_t *)mBuffer->data() + mBuffer->range_offset();
 
         size_t nal_size = parseNALSize(src);
-        if (mBuffer->range_length() < mNALLengthSize + nal_size) {
+        if (mNALLengthSize > SIZE_MAX - nal_size) {
+            ALOGE("b/24441553, b/24445122");
+        }
+
+        if (mBuffer->range_length() - mNALLengthSize < nal_size) {
             ALOGE("incomplete NAL unit.");
 
             mBuffer->release();