commit 17b625b7f51b75fde6640c737474b8b2c51412bf
author Nick Kralevich <nnk@google.com> Fri Apr 10 23:15:52 2015 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Fri Apr 10 23:15:53 2015 +0000
tree c49fddb7ad3c23378a58212b9239d34f2f7ae99c
parent 030d8d0a557097b88d6ecbf6d04823213512b620
parent 5c134e6b2047b10877f02a46f4bb293537269f00

Merge "Fix integer overflow during MP4 atom processing" into klp-dev

media/libstagefright/SampleTable.cpp

diff --git a/media/libstagefright/SampleTable.cpp b/media/libstagefright/SampleTable.cpp
index 4d8d703..a7ceecb 100644
--- a/media/libstagefright/SampleTable.cpp
+++ b/media/libstagefright/SampleTable.cpp
@@ -333,7 +333,7 @@
     }
 
     mTimeToSampleCount = U32_AT(&header[4]);
-    uint64_t allocSize = mTimeToSampleCount * 2 * sizeof(uint32_t);
+    uint64_t allocSize = mTimeToSampleCount * 2 * (uint64_t)sizeof(uint32_t);
     if (allocSize > SIZE_MAX) {
         return ERROR_OUT_OF_RANGE;
     }
@@ -379,7 +379,7 @@
     }
 
     mNumCompositionTimeDeltaEntries = numEntries;
-    uint64_t allocSize = numEntries * 2 * sizeof(uint32_t);
+    uint64_t allocSize = numEntries * 2 * (uint64_t)sizeof(uint32_t);
     if (allocSize > SIZE_MAX) {
         return ERROR_OUT_OF_RANGE;
     }
@@ -429,7 +429,7 @@
         ALOGV("Table of sync samples is empty or has only a single entry!");
     }
 
-    uint64_t allocSize = mNumSyncSamples * sizeof(uint32_t);
+    uint64_t allocSize = mNumSyncSamples * (uint64_t)sizeof(uint32_t);
     if (allocSize > SIZE_MAX) {
         return ERROR_OUT_OF_RANGE;
     }