commit 0dd00d9b1986cd2cc4f45bdb96266dee01f20d72
author Marco Nelissen <marcone@google.com> Tue Jan 12 23:12:55 2016 +0000
committer android-build-merger <android-build-merger@google.com> Tue Jan 12 23:12:55 2016 +0000
tree db8dd81b9846c9c29eab3234965e95271d98e6a5
parent 62e7493876a9b8db0a4e1930ce24d3f1a8f32cb8
parent e463301aa44f0ea0ae1a2399bf8800d94cf6ce3e

Fix out-of-bounds write am: 5403587a74 am: fb2eb86102 am: e6bd186c7e am: a8ac8f617b am: e2e46f5fa1 am: 2304c606eb am: 0945199000 am: a39f981875
am: e463301aa4

* commit 'e463301aa44f0ea0ae1a2399bf8800d94cf6ce3e':
  Fix out-of-bounds write

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index bfdff38..e4f8384 100755
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -4545,7 +4545,15 @@
                     continue;
                 }
 
-                CHECK(dstOffset + 4 <= mBuffer->size());
+                if (dstOffset > SIZE_MAX - 4 ||
+                        dstOffset + 4 > SIZE_MAX - nalLength ||
+                        dstOffset + 4 + nalLength > mBuffer->size()) {
+                    ALOGE("b/26365349 : %zu %zu", dstOffset, mBuffer->size());
+                    android_errorWriteLog(0x534e4554, "26365349");
+                    mBuffer->release();
+                    mBuffer = NULL;
+                    return ERROR_MALFORMED;
+                }
 
                 dstData[dstOffset++] = 0;
                 dstData[dstOffset++] = 0;