commit 49dc63bcc8c972b2d25fd88c6a47dd1a03b175c6
author Dongwon Kang <dwkang@google.com> Sat Jun 17 05:28:42 2017 +0000
committer android-build-merger <android-build-merger@google.com> Sat Jun 17 05:28:42 2017 +0000
tree c635c4a286a438f33baad463ae8d0aa7000e261c
parent 2f0a855d846a17eaea60255e5a478958548ce0da
parent d0884dfadc45f6614b3f1b3938e0d7d20d71cb45

Merge "MPEG4Extractor: check size for yrrc box" into lmp-dev am: d971d18873 am: 2ace148c06 am: 18a671762d am: 6ce4126a09 am: 040485c1bc am: 6e5ef73033 am: 9262a0d58f am: 7c70a5482c am: e4c62e4582 am: 1efa35d1f8 am: 55acba9047 am: 3f05d8a9bc am: 3aaf1671d5 am: af69fd92a9
am: d0884dfadc

Change-Id: Ic52b9a41d24d9d5c789114d57ac01a61e8ca436a

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index bbdcf0b..ecd62b0 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -3125,6 +3125,13 @@
         }
         case FOURCC('y', 'r', 'r', 'c'):
         {
+            if (size < 6) {
+                delete[] buffer;
+                buffer = NULL;
+                ALOGE("b/62133227");
+                android_errorWriteLog(0x534e4554, "62133227");
+                return ERROR_MALFORMED;
+            }
             char tmp[5];
             uint16_t year = U16_AT(&buffer[4]);
 
@@ -3147,6 +3154,8 @@
 
         // smallest possible valid UTF-16 string w BOM: 0xfe 0xff 0x00 0x00
         if (size < 6) {
+            delete[] buffer;
+            buffer = NULL;
             return ERROR_MALFORMED;
         }