commit 82e90e10481c334bb5f2cecf1621cb8f9308c21c
author Wei Jia <wjia@google.com> Fri Jun 05 16:13:39 2015 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Fri Jun 05 16:13:40 2015 +0000
tree 8e831809c6a28deef10d37ff73409b351b4343af
parent 4a492bf2ac47b9844d2527e1fcdf0064c3d8d52e
parent e5f0966c76bd0a7e81e4205c8d8b55e6b34c833e

Merge "Fix integer overflow when handling MPEG4 tx3g atom" into klp-dev

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 3d15090..2efbb57 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -1765,6 +1765,10 @@
                     return ERROR_IO;
                 }
                 const int kSkipBytesOfDataBox = 16;
+                if (chunk_data_size <= kSkipBytesOfDataBox) {
+                    return ERROR_MALFORMED;
+                }
+
                 mFileMetaData->setData(
                     kKeyAlbumArt, MetaData::TYPE_NONE,
                     buffer->data() + kSkipBytesOfDataBox, chunk_data_size - kSkipBytesOfDataBox);