commit f1790258494751adc629126666e7dd81bbc8afbd
author Marco Nelissen <marcone@google.com> Tue Oct 06 20:24:45 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Tue Oct 06 20:24:45 2015 +0000
tree d96e3ae02d9d87f207686a5ea8ab21c6fbfc7e8a
parent b8f5d50cd652b4ff6121b9107b5dd7d91ca5929e
parent 5e92fdede2391b77cff5fe914d748e1023d0ef90

am 5e92fded: am 64cdd5f2: am f2cf2bd7: am 07395f4c: am 00f5fa82: am 74d1927e: Merge "Check NAL size before use" into klp-dev

* commit '5e92fdede2391b77cff5fe914d748e1023d0ef90':
  Check NAL size before use

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 96423e6..92cc771 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -3910,7 +3910,10 @@
             (const uint8_t *)mBuffer->data() + mBuffer->range_offset();
 
         size_t nal_size = parseNALSize(src);
-        if (mBuffer->range_length() < mNALLengthSize + nal_size) {
+        if (mNALLengthSize > SIZE_MAX - nal_size) {
+            ALOGE("b/24441553, b/24445122");
+        }
+        if (mBuffer->range_length() - mNALLengthSize < nal_size) {
             ALOGE("incomplete NAL unit.");
 
             mBuffer->release();
@@ -4197,7 +4200,11 @@
             (const uint8_t *)mBuffer->data() + mBuffer->range_offset();
 
         size_t nal_size = parseNALSize(src);
-        if (mBuffer->range_length() < mNALLengthSize + nal_size) {
+        if (mNALLengthSize > SIZE_MAX - nal_size) {
+            ALOGE("b/24441553, b/24445122");
+        }
+
+        if (mBuffer->range_length() - mNALLengthSize < nal_size) {
             ALOGE("incomplete NAL unit.");
 
             mBuffer->release();