commit 9262a0d58fbbdd8c88fd56b04050ed96f7ce05a0
author Dongwon Kang <dwkang@google.com> Sat Jun 17 05:03:39 2017 +0000
committer android-build-merger <android-build-merger@google.com> Sat Jun 17 05:03:39 2017 +0000
tree 91f6e5850528d61f8ba57c452a4a38ec485e5c7e
parent e2424e989525f332bce80191d5316594b2a08a61
parent 6e5ef73033bbdea8f2bd80885b4c9722b5850384

Merge "MPEG4Extractor: check size for yrrc box" into lmp-dev am: d971d18873 am: 2ace148c06 am: 18a671762d am: 6ce4126a09 am: 040485c1bc
am: 6e5ef73033

Change-Id: I6d7aef658319bc6bbd43076d43788d2235dd14f6

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 0996cdf..f0c633b 100755
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -2753,6 +2753,13 @@
         }
         case FOURCC('y', 'r', 'r', 'c'):
         {
+            if (size < 6) {
+                delete[] buffer;
+                buffer = NULL;
+                ALOGE("b/62133227");
+                android_errorWriteLog(0x534e4554, "62133227");
+                return ERROR_MALFORMED;
+            }
             char tmp[5];
             uint16_t year = U16_AT(&buffer[4]);
 
@@ -2775,6 +2782,8 @@
 
         // smallest possible valid UTF-16 string w BOM: 0xfe 0xff 0x00 0x00
         if (size < 6) {
+            delete[] buffer;
+            buffer = NULL;
             return ERROR_MALFORMED;
         }