Merge "NuPlayerStreamListener: NULL and bounds check before memcpy" into klp-dev am: 4fa31b5 am: 6ee73da am: 9ef3f17 am: 8278e43 am: 093cd05 am: 05cb2d8 am: 5042d77 am: 6d1599d am: 297a8d2
am: 539826f
* commit '539826f278dadc8041467713790ffe5b54572d6e':
NuPlayerStreamListener: NULL and bounds check before memcpy
diff --git a/media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp b/media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp
index f53afbd..ee70306 100644
--- a/media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp
+++ b/media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp
@@ -144,8 +144,17 @@
copy = size;
}
+ if (entry->mIndex >= mBuffers.size()) {
+ return ERROR_MALFORMED;
+ }
+
+ sp<IMemory> mem = mBuffers.editItemAt(entry->mIndex);
+ if (mem == NULL || mem->size() < copy || mem->size() - copy < entry->mOffset) {
+ return ERROR_MALFORMED;
+ }
+
memcpy(data,
- (const uint8_t *)mBuffers.editItemAt(entry->mIndex)->pointer()
+ (const uint8_t *)mem->pointer()
+ entry->mOffset,
copy);