| commit | a061b88c1daba1956eaac06e378e961f71172690 | [log] [tgz] |
|---|---|---|
| author | Iván Budnik <ivanbuper@google.com> | Wed Jun 22 17:52:40 2022 +0000 |
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | Wed Jun 22 17:52:40 2022 +0000 |
| tree | ba75d63b70a78b1ea8a0d6ce06fb81531f35b1cf | |
| parent | a8ab3184ffb463e86c038bf0d387a6ec78fc9ca9 [diff] | |
| parent | d8dad2770ec387d87062a1a75c94003d86d1fc0e [diff] |
Fix Out of Bounds read in TextDescriptions.cpp am: b63d4e785b am: a18815ba8d am: d8dad2770e Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/18993507 Change-Id: Ie6c8f2130be5e7da7016893632660ca3bb740bbb Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/media/libstagefright/timedtext/TextDescriptions.cpp b/media/libstagefright/timedtext/TextDescriptions.cpp index 2c2d11d..3fec9ed 100644 --- a/media/libstagefright/timedtext/TextDescriptions.cpp +++ b/media/libstagefright/timedtext/TextDescriptions.cpp
@@ -466,6 +466,10 @@ if (subChunkType == FOURCC('f', 't', 'a', 'b')) { + if(subChunkSize < 8) { + return OK; + } + tmpData += 8; size_t subChunkRemaining = subChunkSize - 8;