| commit | 9850bfbc13e319e32b2996fdf2a773519618a055 | [log] [tgz] |
|---|---|---|
| author | Iván Budnik <ivanbuper@google.com> | Wed Jun 22 18:37:38 2022 +0000 |
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | Wed Jun 22 18:37:38 2022 +0000 |
| tree | 175fd40a175b3cda81ab025951e336ffefc1a801 | |
| parent | ed08fbe1381f2de16c6ef4247436610443c5a2ed [diff] | |
| parent | e7caf5cd47f89a3adb22e4419481b1786a49bb5b [diff] |
Fix Out of Bounds read in TextDescriptions.cpp am: b63d4e785b am: a18815ba8d am: d8dad2770e am: 4803c5c3a5 am: e7caf5cd47 Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/18993507 Change-Id: I4480a8caf35e36320c1dd467544e7acba37c5fd6 Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/media/libstagefright/timedtext/TextDescriptions.cpp b/media/libstagefright/timedtext/TextDescriptions.cpp index 2c2d11d..3fec9ed 100644 --- a/media/libstagefright/timedtext/TextDescriptions.cpp +++ b/media/libstagefright/timedtext/TextDescriptions.cpp
@@ -466,6 +466,10 @@ if (subChunkType == FOURCC('f', 't', 'a', 'b')) { + if(subChunkSize < 8) { + return OK; + } + tmpData += 8; size_t subChunkRemaining = subChunkSize - 8;