commit f452267ae8b167c108c060694aa60f6f9674dcb6
author TreeHugger Robot <treehugger-gerrit@google.com> Tue Aug 14 23:49:37 2018 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Tue Aug 14 23:49:37 2018 +0000
tree e08c9f3642a1a4526770df82826b7b6327c4de66
parent 1b227ecd315e902630af71c7d2b34e8f5250a01c
parent c1bf68a8d1321d7cdf7da6933f0b89b171d251c6

Merge "Fix information disclosure in mediadrmserver" into oc-dev

media/ndk/NdkMediaCodec.cpp

diff --git a/media/ndk/NdkMediaCodec.cpp b/media/ndk/NdkMediaCodec.cpp
index 6d02cf1..6faa19f 100644
--- a/media/ndk/NdkMediaCodec.cpp
+++ b/media/ndk/NdkMediaCodec.cpp
@@ -553,7 +553,13 @@
         size_t *encryptedbytes) {
 
     // size needed to store all the crypto data
-    size_t cryptosize = sizeof(AMediaCodecCryptoInfo) + sizeof(size_t) * numsubsamples * 2;
+    size_t cryptosize;
+    // = sizeof(AMediaCodecCryptoInfo) + sizeof(size_t) * numsubsamples * 2;
+    if (__builtin_mul_overflow(sizeof(size_t) * 2, numsubsamples, &cryptosize) ||
+            __builtin_add_overflow(cryptosize, sizeof(AMediaCodecCryptoInfo), &cryptosize)) {
+        ALOGE("crypto size overflow");
+        return NULL;
+    }
     AMediaCodecCryptoInfo *ret = (AMediaCodecCryptoInfo*) malloc(cryptosize);
     if (!ret) {
         ALOGE("couldn't allocate %zu bytes", cryptosize);