commit db0d4cc3184f400dcbb841f274d5b6f4c8400550
author Marco Nelissen <marcone@google.com> Tue Feb 07 22:01:41 2017 +0000
committer android-build-merger <android-build-merger@google.com> Tue Feb 07 22:01:41 2017 +0000
tree a0785146930fad325889ed3e1a4655ffc8c1e434
parent b16ebe1450d4a1d240175a2a9c0c63563d610f1e
parent 3bcc22b176cdd33e3abfe004a3ea3314e7e42a30

Merge "Fix potential overflows" am: a0c1eb865f am: ef3542347c am: 2774f292b7
am: 3bcc22b176

Change-Id: I78bd28ee6abb4befea5c46c8d4be8799b88b227b

media/libstagefright/SampleIterator.cpp

diff --git a/media/libstagefright/SampleIterator.cpp b/media/libstagefright/SampleIterator.cpp
index 54c9fa3..8ddf7f3 100644
--- a/media/libstagefright/SampleIterator.cpp
+++ b/media/libstagefright/SampleIterator.cpp
@@ -305,8 +305,16 @@
         return ERROR_OUT_OF_RANGE;
     }
 
-    while (sampleIndex >= mTTSSampleIndex + mTTSCount) {
-        if (mTimeToSampleIndex == mTable->mTimeToSampleCount) {
+    while (true) {
+        if (mTTSSampleIndex > UINT32_MAX - mTTSCount) {
+            return ERROR_OUT_OF_RANGE;
+        }
+        if(sampleIndex < mTTSSampleIndex + mTTSCount) {
+            break;
+        }
+        if (mTimeToSampleIndex == mTable->mTimeToSampleCount ||
+            mTTSCount > UINT32_MAX / mTTSDuration ||
+            mTTSSampleTime > UINT32_MAX - (mTTSCount * mTTSDuration)) {
             return ERROR_OUT_OF_RANGE;
         }