OSDN Git Service

Fix integer underflow in ESDS processing
authorJoshua J. Drake <android-open-source@qoop.org>
Thu, 9 Apr 2015 04:53:10 +0000 (23:53 -0500)
committerNick Kralevich <nnk@google.com>
Fri, 10 Apr 2015 01:47:03 +0000 (18:47 -0700)
commit0e4e5a8c09c63548f2a00c77ab5038b7703384bc
tree1bbcd7c4631dd284467e4e1e45327e7392602a9f
parentae6965ae7664aaea489a8d58358035610075c9af
Fix integer underflow in ESDS processing

Several arithmetic operations within parseESDescriptor could underflow, leading
to an out-of-bounds read operation. Ensure that subtractions from 'size' do not
cause it to wrap around.

Bug: 20139950

(cherry picked from commit 07c0f59d6c48874982d2b5c713487612e5af465a)

Change-Id: I377d21051e07ca654ea1f7037120429d3f71924a
media/libstagefright/ESDS.cpp