commit 0d342b9a11557e228d6c94be92579d891ba830d8
author Nick Kralevich <nnk@google.com> Fri May 08 03:25:56 2015 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Fri May 08 03:25:56 2015 +0000
tree 1acfe18645f9971176cd07be7f49da4cd611c65d
parent cf85459e2f8cb2873fffc4e8fd05a5ba6c149972
parent 97d45dbfdfc9018f1cbf72641c1447ff59431ae3

Merge "Fix integer underflow in covr MPEG4 processing" into mnc-dev

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 1f1d751..7bcf181 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -2022,6 +2022,10 @@
                     return ERROR_IO;
                 }
                 const int kSkipBytesOfDataBox = 16;
+                if (chunk_data_size <= kSkipBytesOfDataBox) {
+                    return ERROR_MALFORMED;
+                }
+
                 mFileMetaData->setData(
                     kKeyAlbumArt, MetaData::TYPE_NONE,
                     buffer->data() + kSkipBytesOfDataBox, chunk_data_size - kSkipBytesOfDataBox);