commit 876742d2526fdf03190dad2ab9deb76b7c02939f
author Andreas Huber <andih@google.com> Thu Sep 16 15:20:33 2010 -0700
committer Android (Google) Code Review <android-gerrit@google.com> Thu Sep 16 15:20:33 2010 -0700
tree 84dc5369e67cca93ece62c973b9efcc1908c5c0c
parent 102dfe09e7b58efc2d67c212779d2ac3a0be5204
parent 104fcb88d4125caff74f63be4ce23537ca693ac7

Merge "Make sure the .wav extractor does not read data outside the bounds of the 'data' box." into gingerbread

media/libstagefright/WAVExtractor.cpp

diff --git a/media/libstagefright/WAVExtractor.cpp b/media/libstagefright/WAVExtractor.cpp
index 57c1075..aff06bc 100644
--- a/media/libstagefright/WAVExtractor.cpp
+++ b/media/libstagefright/WAVExtractor.cpp
@@ -331,9 +331,20 @@
         return err;
     }
 
+    size_t maxBytesToRead =
+        mBitsPerSample == 8 ? kMaxFrameSize / 2 : kMaxFrameSize;
+
+    size_t maxBytesAvailable =
+        (mCurrentPos - mOffset >= (off_t)mSize)
+            ? 0 : mSize - (mCurrentPos - mOffset);
+
+    if (maxBytesToRead > maxBytesAvailable) {
+        maxBytesToRead = maxBytesAvailable;
+    }
+
     ssize_t n = mDataSource->readAt(
             mCurrentPos, buffer->data(),
-            mBitsPerSample == 8 ? kMaxFrameSize / 2 : kMaxFrameSize);
+            maxBytesToRead);
 
     if (n <= 0) {
         buffer->release();