Prevent overflow of unsigned variable
Bug: 184430260
Test: atest CtsMediaTestCases:MediaExtractorTest
Test: atest CtsMediaTestCases:MediaPlayerTest
Test: Ran fuzzer test case in linked bug.
Change-Id: I6e333943c6527dabbf4ad4bd213560952ce0a9c1
diff --git a/media/extractors/mkv/MatroskaExtractor.cpp b/media/extractors/mkv/MatroskaExtractor.cpp
index 4fd3a56..443e26c 100644
--- a/media/extractors/mkv/MatroskaExtractor.cpp
+++ b/media/extractors/mkv/MatroskaExtractor.cpp
@@ -1700,17 +1700,17 @@
return ERROR_MALFORMED;
}
- size_t header_start = 0;
- size_t header_lenth = 0;
+ long header_start = 0;
+ long header_length = 0;
for (header_start = 0; header_start < frame.len - 4; header_start++) {
if (ntohl(0x000001b3) == *(uint32_t*)((uint8_t*)tmpData.get() + header_start)) {
break;
}
}
bool isComplete_csd = false;
- for (header_lenth = 0; header_lenth < frame.len - 4 - header_start; header_lenth++) {
+ for (header_length = 0; header_length < frame.len - 4 - header_start; header_length++) {
if (ntohl(0x000001b8) == *(uint32_t*)((uint8_t*)tmpData.get()
- + header_start + header_lenth)) {
+ + header_start + header_length)) {
isComplete_csd = true;
break;
}
@@ -1720,7 +1720,7 @@
return ERROR_MALFORMED;
}
addESDSFromCodecPrivate(trackInfo->mMeta, false,
- (uint8_t*)(tmpData.get()) + header_start, header_lenth);
+ (uint8_t*)(tmpData.get()) + header_start, header_length);
return OK;