commit 57374fb97bbdfcfab19d3b6ded4a9e5f69a709b8
author Marco Nelissen <marcone@google.com> Wed Feb 24 22:45:09 2016 +0000
committer android-build-merger <android-build-merger@google.com> Wed Feb 24 22:45:09 2016 +0000
tree 4c9e6a961bc49faa3d3b892e564f38aedb5e2f4b
parent 7228d57873ebed45a2873bc0e4bc026c53fc979d
parent 9d537cb7933729b9114e5bc394d6ab35f906b20c

Merge "Also fix out of bounds access for normal read" into klp-dev am: dc17049b02 am: fc4f739667 am: 2bb66e2541 am: 5371723cf3 am: 9f31a89385 am: 037bdfc7e4 am: 1a9b5e0fa3 am: 3c69e8d5fd am: 8aa22eeac9 am: 23020eade4
am: 9d537cb793

* commit '9d537cb7933729b9114e5bc394d6ab35f906b20c':
  Also fix out of bounds access for normal read

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 6f4a65b..d5a869d 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -4279,7 +4279,15 @@
                     continue;
                 }
 
-                CHECK(dstOffset + 4 <= mBuffer->size());
+                if (dstOffset > SIZE_MAX - 4 ||
+                        dstOffset + 4 > SIZE_MAX - nalLength ||
+                        dstOffset + 4 + nalLength > mBuffer->size()) {
+                    ALOGE("b/27208621 : %zu %zu", dstOffset, mBuffer->size());
+                    android_errorWriteLog(0x534e4554, "27208621");
+                    mBuffer->release();
+                    mBuffer = NULL;
+                    return ERROR_MALFORMED;
+                }
 
                 dstData[dstOffset++] = 0;
                 dstData[dstOffset++] = 0;