commit 86a97a8d1ac03f96e0e8ecc42ba28d0c58e24fcc
author Robert Shih <robertshih@google.com> Fri Jan 12 20:10:32 2018 +0000
committer android-build-merger <android-build-merger@google.com> Fri Jan 12 20:10:32 2018 +0000
tree 18993652a1cd653d44392e4a3bd0bc957c245526
parent 8d78f41079d30cbbcaff7e9b02ce1dc629b43611
parent 42495748d7636252f4b3cfaeb3d72cbad5ad1a25

AACExtractor: check bounds during seek am: 0790581021 am: a896e5b77a am: be8e054c7a
am: 42495748d7

Change-Id: I0c251c7849cad51d3982f8e5c091b23f94b3f7f8

media/libstagefright/AACExtractor.cpp

diff --git a/media/libstagefright/AACExtractor.cpp b/media/libstagefright/AACExtractor.cpp
index 45e8a30..9e46876 100644
--- a/media/libstagefright/AACExtractor.cpp
+++ b/media/libstagefright/AACExtractor.cpp
@@ -292,6 +292,10 @@
     if (options && options->getSeekTo(&seekTimeUs, &mode)) {
         if (mFrameDurationUs > 0) {
             int64_t seekFrame = seekTimeUs / mFrameDurationUs;
+            if (seekFrame < 0 || seekFrame >= (int64_t)mOffsetVector.size()) {
+                android_errorWriteLog(0x534e4554, "70239507");
+                return ERROR_MALFORMED;
+            }
             mCurrentTimeUs = seekFrame * mFrameDurationUs;
 
             mOffset = mOffsetVector.itemAt(seekFrame);