commit 64cdd5f243ffdb9460ae3d17bd2a732560fc8395
author Marco Nelissen <marcone@google.com> Tue Oct 06 20:11:47 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Tue Oct 06 20:11:47 2015 +0000
tree 04d6b4c67268af1badb84cf9d6925bfca7dafcc4
parent fb0d63df2393a5e20cbb16d90ed5c01295a81836
parent f2cf2bd7448734c6881e3bea2b758f2bf9feeed9

am f2cf2bd7: am 07395f4c: am 00f5fa82: am 74d1927e: Merge "Check NAL size before use" into klp-dev

* commit 'f2cf2bd7448734c6881e3bea2b758f2bf9feeed9':
  Check NAL size before use

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 69eab99..7d7cf07 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -3900,7 +3900,10 @@
             (const uint8_t *)mBuffer->data() + mBuffer->range_offset();
 
         size_t nal_size = parseNALSize(src);
-        if (mBuffer->range_length() < mNALLengthSize + nal_size) {
+        if (mNALLengthSize > SIZE_MAX - nal_size) {
+            ALOGE("b/24441553, b/24445122");
+        }
+        if (mBuffer->range_length() - mNALLengthSize < nal_size) {
             ALOGE("incomplete NAL unit.");
 
             mBuffer->release();
@@ -4187,7 +4190,11 @@
             (const uint8_t *)mBuffer->data() + mBuffer->range_offset();
 
         size_t nal_size = parseNALSize(src);
-        if (mBuffer->range_length() < mNALLengthSize + nal_size) {
+        if (mNALLengthSize > SIZE_MAX - nal_size) {
+            ALOGE("b/24441553, b/24445122");
+        }
+
+        if (mBuffer->range_length() - mNALLengthSize < nal_size) {
             ALOGE("incomplete NAL unit.");
 
             mBuffer->release();