commit 3cce4937ae9bb3a522bee74a47807c8cf0b462d5
author Chad Brubaker <cbrubaker@google.com> Fri Oct 09 21:14:33 2015 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Fri Oct 09 21:14:33 2015 +0000
tree 8da5d2c7525e65b5042fd80c8a96fcaf3434c13e
parent 49bf11936cadb96a65a81e71515b1246f55e689a
parent cbcd8dd1967af30ff035132328002c0ec9a8872e

Merge "Fix benign overflow in SampleIterator"

media/libstagefright/SampleIterator.cpp

diff --git a/media/libstagefright/SampleIterator.cpp b/media/libstagefright/SampleIterator.cpp
index 2748349..032bbb9 100644
--- a/media/libstagefright/SampleIterator.cpp
+++ b/media/libstagefright/SampleIterator.cpp
@@ -166,6 +166,13 @@
         if (mSampleToChunkIndex + 1 < mTable->mNumSampleToChunkOffsets) {
             mStopChunk = entry[1].startChunk;
 
+            if (mStopChunk < mFirstChunk ||
+                (mStopChunk - mFirstChunk) > UINT32_MAX / mSamplesPerChunk ||
+                ((mStopChunk - mFirstChunk) * mSamplesPerChunk >
+                 UINT32_MAX - mFirstChunkSampleIndex)) {
+
+                return ERROR_OUT_OF_RANGE;
+            }
             mStopChunkSampleIndex =
                 mFirstChunkSampleIndex
                     + (mStopChunk - mFirstChunk) * mSamplesPerChunk;