commit c236ae3ad09b8d7a459daad3041af214b4b648f6
author Marco Nelissen <marcone@google.com> Mon Nov 14 20:27:34 2016 +0000
committer android-build-merger <android-build-merger@google.com> Mon Nov 14 20:27:34 2016 +0000
tree 6204ad55e9bcebd03d9e0427c7cbbe72646fdbb8
parent 4f58afc95197018d94d1056ec1803c5af62babd0
parent 82642824a57367de89be82f4fc9bb10eb63539d6

Make VBRISeeker more robust am: 7fdd36418e am: ae0cffaced
am: 82642824a5

Change-Id: Ia7eb6656c3034793e8caea2b417d99fa0702d05d

media/libstagefright/VBRISeeker.cpp

diff --git a/media/libstagefright/VBRISeeker.cpp b/media/libstagefright/VBRISeeker.cpp
index e988f6d..8001331 100644
--- a/media/libstagefright/VBRISeeker.cpp
+++ b/media/libstagefright/VBRISeeker.cpp
@@ -83,8 +83,23 @@
          scale,
          entrySize);
 
+    if (entrySize > 4) {
+        ALOGE("invalid VBRI entry size: %zu", entrySize);
+        return NULL;
+    }
+
+    sp<VBRISeeker> seeker = new (std::nothrow) VBRISeeker;
+    if (seeker == NULL) {
+        ALOGW("Couldn't allocate VBRISeeker");
+        return NULL;
+    }
+
     size_t totalEntrySize = numEntries * entrySize;
-    uint8_t *buffer = new uint8_t[totalEntrySize];
+    uint8_t *buffer = new (std::nothrow) uint8_t[totalEntrySize];
+    if (!buffer) {
+        ALOGW("Couldn't allocate %zu bytes", totalEntrySize);
+        return NULL;
+    }
 
     n = source->readAt(pos + sizeof(vbriHeader), buffer, totalEntrySize);
     if (n < (ssize_t)totalEntrySize) {
@@ -94,7 +109,6 @@
         return NULL;
     }
 
-    sp<VBRISeeker> seeker = new VBRISeeker;
     seeker->mBasePos = post_id3_pos + frameSize;
     // only update mDurationUs if the calculated duration is valid (non zero)
     // otherwise, leave duration at -1 so that getDuration() and getOffsetForTime()