commit e6bd186c7e2a3b948fdd27a4b71048ee85229e7c
author Marco Nelissen <marcone@google.com> Tue Jan 12 22:56:21 2016 +0000
committer android-build-merger <android-build-merger@google.com> Tue Jan 12 22:56:21 2016 +0000
tree 5ad9e8c5ced3a5542c25e6ad57323e4163e84000
parent 3a9d4f4a83341e4c083aa50a651fe5d765ef70ad
parent fb2eb8610208d3ad2ea69f57a151ffe436c6c6e6

Fix out-of-bounds write am: 5403587a74
am: fb2eb86102

* commit 'fb2eb8610208d3ad2ea69f57a151ffe436c6c6e6':
  Fix out-of-bounds write

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 4c9b458..433941c 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -4294,7 +4294,15 @@
                     continue;
                 }
 
-                CHECK(dstOffset + 4 <= mBuffer->size());
+                if (dstOffset > SIZE_MAX - 4 ||
+                        dstOffset + 4 > SIZE_MAX - nalLength ||
+                        dstOffset + 4 + nalLength > mBuffer->size()) {
+                    ALOGE("b/26365349 : %zu %zu", dstOffset, mBuffer->size());
+                    android_errorWriteLog(0x534e4554, "26365349");
+                    mBuffer->release();
+                    mBuffer = NULL;
+                    return ERROR_MALFORMED;
+                }
 
                 dstData[dstOffset++] = 0;
                 dstData[dstOffset++] = 0;