commit df68d9d5bf5329bc2f7effb6afa1d3904eaf30d8
author Wei Jia <wjia@google.com> Tue Oct 06 16:38:51 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Tue Oct 06 16:38:51 2015 +0000
tree 351e7418e7b246e6355d733dda07997985862758
parent 13b6b51e6d9c399f0bfa55be4eecaf47b63845f2
parent 60b25aa0c173854593743dd85588c7449baf87c0

am 60b25aa0: am 9ab9c85e: Merge "MPEG4Extractor: ensure buffer size is not less than 8 for LastCommentData." into klp-dev

* commit '60b25aa0c173854593743dd85588c7449baf87c0':
  MPEG4Extractor: ensure buffer size is not less than 8 for LastCommentData.

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index e09ecc2..d9975bb 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -2347,6 +2347,12 @@
                     mLastCommentName.setTo((const char *)buffer + 4);
                     break;
                 case FOURCC('d', 'a', 't', 'a'):
+                    if (size < 8) {
+                        delete[] buffer;
+                        buffer = NULL;
+                        ALOGE("b/24346430");
+                        return ERROR_MALFORMED;
+                    }
                     mLastCommentData.setTo((const char *)buffer + 8);
                     break;
             }