commit 0f2041fd46a87dac81ba53c1db3a03f169fdbdb8
author Santiago Seifert <aquilescanta@google.com> Fri Jun 11 19:12:28 2021 +0100
committer Santiago Seifert <aquilescanta@google.com> Fri Jun 11 20:47:50 2021 +0000
tree 73c25b2770100358ff82ba1b61b9d4e538c7de22
parent 8c3219d7f0fbd89ea1f32afa3604cf2072b88ad8

Abort operation upon arithmetic overflows

Bug: 185394935
Test: atest CtsMediaTestCases:MediaExtractorTest
Test: atest CtsMediaTestCases:MediaPlayerTest
Change-Id: Idf119d823318645fb751f99191a7b80b09ae551a

media/extractors/mp3/MP3Extractor.cpp

diff --git a/media/extractors/mp3/MP3Extractor.cpp b/media/extractors/mp3/MP3Extractor.cpp
index 5bbabdf..248a39c 100644
--- a/media/extractors/mp3/MP3Extractor.cpp
+++ b/media/extractors/mp3/MP3Extractor.cpp
@@ -504,7 +504,14 @@
             }
 
             mCurrentTimeUs = seekTimeUs;
-            mCurrentPos = mFirstFramePos + seekTimeUs * bitrate / 8000000;
+            int64_t seekTimeUsTimesBitrate;
+            if (__builtin_mul_overflow(seekTimeUs, bitrate, &seekTimeUsTimesBitrate)) {
+              return AMEDIA_ERROR_UNSUPPORTED;
+            }
+            if (__builtin_add_overflow(
+                    mFirstFramePos, seekTimeUsTimesBitrate / 8000000, &mCurrentPos)) {
+                return AMEDIA_ERROR_UNSUPPORTED;
+            }
             seekCBR = true;
         } else {
             mCurrentTimeUs = actualSeekTimeUs;