commit 07802f431e9f138dd6ed702d05636b26ac1f9346
author Atneya Nair <atneya@google.com> Fri Sep 23 11:35:31 2022 -0700
committer Atneya Nair <atneya@google.com> Fri Sep 23 11:35:31 2022 -0700
tree 391e05e006c6fa30ad91a404b9668b37f0d33e52
parent 0c4d66a2e9a4433636d3688ef0d11fb74e869c7a
parent 9433ff3ab852b8f68a6b98d195d9c1b7675d2d85

resolve merge conflicts of 9433ff3ab852b8f68a6b98d195d9c1b7675d2d85 to tm-qpr-dev-plus-aosp

Test: Compiles
Bug: None
Change-Id: I90d9d4fc98b6434c14ddf213d0e3c1075a7eb5ee

media/module/extractors/mp4/MPEG4Extractor.cpp

diff --git a/media/module/extractors/mp4/MPEG4Extractor.cpp b/media/module/extractors/mp4/MPEG4Extractor.cpp
index 374f8d3..2e889e3 100644
--- a/media/module/extractors/mp4/MPEG4Extractor.cpp
+++ b/media/module/extractors/mp4/MPEG4Extractor.cpp
@@ -5908,12 +5908,18 @@
             return -EINVAL;
         }
 
-        int32_t dataOffsetDelta;
-        if (!mDataSource->getUInt32(offset, (uint32_t*)&dataOffsetDelta)) {
+        uint32_t dataOffsetDelta;
+        if (!mDataSource->getUInt32(offset, &dataOffsetDelta)) {
             return ERROR_MALFORMED;
         }
 
-        dataOffset = mTrackFragmentHeaderInfo.mBaseDataOffset + dataOffsetDelta;
+        if (__builtin_add_overflow(
+                mTrackFragmentHeaderInfo.mBaseDataOffset, dataOffsetDelta, &dataOffset)) {
+            ALOGW("b/232242894 mBaseDataOffset(%" PRIu64 ") + dataOffsetDelta(%u) overflows uint64",
+                    mTrackFragmentHeaderInfo.mBaseDataOffset, dataOffsetDelta);
+            android_errorWriteLog(0x534e4554, "232242894");
+            return ERROR_MALFORMED;
+        }
 
         offset += 4;
         size -= 4;
@@ -6047,7 +6053,12 @@
             return NO_MEMORY;
         }
 
-        dataOffset += sampleSize;
+        if (__builtin_add_overflow(dataOffset, sampleSize, &dataOffset)) {
+            ALOGW("b/232242894 dataOffset(%" PRIu64 ") + sampleSize(%u) overflows uint64",
+                    dataOffset, sampleSize);
+            android_errorWriteLog(0x534e4554, "232242894");
+            return ERROR_MALFORMED;
+        }
     }
 
     mTrackFragmentHeaderInfo.mDataOffset = dataOffset;