commit 3bcc22b176cdd33e3abfe004a3ea3314e7e42a30
author Marco Nelissen <marcone@google.com> Tue Feb 07 21:58:47 2017 +0000
committer android-build-merger <android-build-merger@google.com> Tue Feb 07 21:58:47 2017 +0000
tree 9dd85e38d98d01a5a116923e3d618b77651d53ac
parent b89c2bb45fbe6e461d24242a82dbd9dc7e070370
parent 2774f292b726ce578091f9a3419d56f1d537f9e6

Merge "Fix potential overflows" am: a0c1eb865f am: ef3542347c
am: 2774f292b7

Change-Id: I1c46b0367639fa29830c74ce92f14c295d178b2c

media/libstagefright/SampleIterator.cpp

diff --git a/media/libstagefright/SampleIterator.cpp b/media/libstagefright/SampleIterator.cpp
index 54c9fa3..8ddf7f3 100644
--- a/media/libstagefright/SampleIterator.cpp
+++ b/media/libstagefright/SampleIterator.cpp
@@ -305,8 +305,16 @@
         return ERROR_OUT_OF_RANGE;
     }
 
-    while (sampleIndex >= mTTSSampleIndex + mTTSCount) {
-        if (mTimeToSampleIndex == mTable->mTimeToSampleCount) {
+    while (true) {
+        if (mTTSSampleIndex > UINT32_MAX - mTTSCount) {
+            return ERROR_OUT_OF_RANGE;
+        }
+        if(sampleIndex < mTTSSampleIndex + mTTSCount) {
+            break;
+        }
+        if (mTimeToSampleIndex == mTable->mTimeToSampleCount ||
+            mTTSCount > UINT32_MAX / mTTSDuration ||
+            mTTSSampleTime > UINT32_MAX - (mTTSCount * mTTSDuration)) {
             return ERROR_OUT_OF_RANGE;
         }