am 26b7dfcf: am 0bde48f5: am 99a1a6a7: am e6ca5b2d: am 566c70ca: Guard against codecinfo overflow
* commit '26b7dfcf65899b79fd339cad62eee293be6b2901':
Guard against codecinfo overflow
diff --git a/media/libstagefright/MetaData.cpp b/media/libstagefright/MetaData.cpp
index 74234a6..7d867b7 100644
--- a/media/libstagefright/MetaData.cpp
+++ b/media/libstagefright/MetaData.cpp
@@ -272,7 +272,12 @@
mType = type;
allocateStorage(size);
- memcpy(storage(), data, size);
+ void *dst = storage();
+ if (!dst) {
+ ALOGE("Couldn't allocate %zu bytes for item", size);
+ return;
+ }
+ memcpy(dst, data, size);
}
void MetaData::typed_data::getData(
diff --git a/media/libstagefright/matroska/MatroskaExtractor.cpp b/media/libstagefright/matroska/MatroskaExtractor.cpp
index 4f0862c..9da835d 100644
--- a/media/libstagefright/matroska/MatroskaExtractor.cpp
+++ b/media/libstagefright/matroska/MatroskaExtractor.cpp
@@ -876,25 +876,38 @@
size_t offset = 1;
size_t len1 = 0;
while (offset < codecPrivateSize && codecPrivate[offset] == 0xff) {
+ if (len1 > (SIZE_MAX - 0xff)) {
+ return ERROR_MALFORMED; // would overflow
+ }
len1 += 0xff;
++offset;
}
if (offset >= codecPrivateSize) {
return ERROR_MALFORMED;
}
+ if (len1 > (SIZE_MAX - codecPrivate[offset])) {
+ return ERROR_MALFORMED; // would overflow
+ }
len1 += codecPrivate[offset++];
size_t len2 = 0;
while (offset < codecPrivateSize && codecPrivate[offset] == 0xff) {
+ if (len2 > (SIZE_MAX - 0xff)) {
+ return ERROR_MALFORMED; // would overflow
+ }
len2 += 0xff;
++offset;
}
if (offset >= codecPrivateSize) {
return ERROR_MALFORMED;
}
+ if (len2 > (SIZE_MAX - codecPrivate[offset])) {
+ return ERROR_MALFORMED; // would overflow
+ }
len2 += codecPrivate[offset++];
- if (codecPrivateSize < offset + len1 + len2) {
+ if (len1 > SIZE_MAX - len2 || offset > SIZE_MAX - (len1 + len2) ||
+ codecPrivateSize < offset + len1 + len2) {
return ERROR_MALFORMED;
}