stagefright: MPEG4Writer: fix Integer overflow
unsigned int was getting assigned to a negative value, which in turn was
leading to a crash in htonl.
Bug: 34757428
Test: Builds cleanly
Change-Id: Iacb580adc5b84cef09feabcb3e1b394a7e80bc40
diff --git a/media/libstagefright/MPEG4Writer.cpp b/media/libstagefright/MPEG4Writer.cpp
index d46ef3c..cafedba 100755
--- a/media/libstagefright/MPEG4Writer.cpp
+++ b/media/libstagefright/MPEG4Writer.cpp
@@ -3669,11 +3669,19 @@
mOwner->beginBox("ctts");
mOwner->writeInt32(0); // version=0, flags=0
- uint32_t delta = mMinCttsOffsetTimeUs - getStartTimeOffsetScaledTime();
+ int64_t delta = mMinCttsOffsetTimeUs - getStartTimeOffsetScaledTime();
mCttsTableEntries->adjustEntries([delta](size_t /* ix */, uint32_t (&value)[2]) {
// entries are <count, ctts> pairs; adjust only ctts
uint32_t duration = htonl(value[1]); // back to host byte order
- value[1] = htonl(duration - delta);
+ // Prevent overflow and underflow
+ if (delta > duration) {
+ duration = 0;
+ } else if (delta < 0 && UINT32_MAX + delta < duration) {
+ duration = UINT32_MAX;
+ } else {
+ duration -= delta;
+ }
+ value[1] = htonl(duration);
});
mCttsTableEntries->write(mOwner);
mOwner->endBox(); // ctts