| commit | d8dad2770ec387d87062a1a75c94003d86d1fc0e | [log] [tgz] |
|---|---|---|
| author | Iván Budnik <ivanbuper@google.com> | Wed Jun 22 17:33:47 2022 +0000 |
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | Wed Jun 22 17:33:47 2022 +0000 |
| tree | 402d786535e085ccd20d91ca0dd3cfe51fd88861 | |
| parent | b2c01cbbc6b66bd7c448c0f1f3cb86ea6c7f2c05 [diff] | |
| parent | a18815ba8d303870b21e01b688c7a290af66b9f9 [diff] |
Fix Out of Bounds read in TextDescriptions.cpp am: b63d4e785b am: a18815ba8d Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/18993507 Change-Id: I0ffcaccbef809d71f4b4c7e32e2c4f640844c9f2 Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/media/libstagefright/timedtext/TextDescriptions.cpp b/media/libstagefright/timedtext/TextDescriptions.cpp index 2c2d11d..3fec9ed 100644 --- a/media/libstagefright/timedtext/TextDescriptions.cpp +++ b/media/libstagefright/timedtext/TextDescriptions.cpp
@@ -466,6 +466,10 @@ if (subChunkType == FOURCC('f', 't', 'a', 'b')) { + if(subChunkSize < 8) { + return OK; + } + tmpData += 8; size_t subChunkRemaining = subChunkSize - 8;