commit 3c69e8d5fdddff1230938f7051caf88ae0944999
author Marco Nelissen <marcone@google.com> Wed Feb 24 22:14:20 2016 +0000
committer android-build-merger <android-build-merger@google.com> Wed Feb 24 22:14:20 2016 +0000
tree 0dfb21cd4c8eb77cd0707d9e5bd060b57f394c6a
parent 52598348340ba20048a1d6304b39b548a95be18f
parent 1a9b5e0fa3518a00102dac5893e6c479b87bbb36

Merge "Also fix out of bounds access for normal read" into klp-dev am: dc17049b02 am: fc4f739667 am: 2bb66e2541 am: 5371723cf3 am: 9f31a89385 am: 037bdfc7e4
am: 1a9b5e0fa3

* commit '1a9b5e0fa3518a00102dac5893e6c479b87bbb36':
  Also fix out of bounds access for normal read

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index f2d30b3..a5a00ef 100755
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -4228,7 +4228,15 @@
                     continue;
                 }
 
-                CHECK(dstOffset + 4 <= mBuffer->size());
+                if (dstOffset > SIZE_MAX - 4 ||
+                        dstOffset + 4 > SIZE_MAX - nalLength ||
+                        dstOffset + 4 + nalLength > mBuffer->size()) {
+                    ALOGE("b/27208621 : %zu %zu", dstOffset, mBuffer->size());
+                    android_errorWriteLog(0x534e4554, "27208621");
+                    mBuffer->release();
+                    mBuffer = NULL;
+                    return ERROR_MALFORMED;
+                }
 
                 dstData[dstOffset++] = 0;
                 dstData[dstOffset++] = 0;