OSDN Git Service

Fix integer underflow in ESDS processing
authorJoshua J. Drake <android-open-source@qoop.org>
Thu, 9 Apr 2015 04:53:10 +0000 (23:53 -0500)
committerNick Kralevich <nnk@google.com>
Mon, 3 Aug 2015 23:23:20 +0000 (16:23 -0700)
commit4dd7cb699f49b56f94a32080fdac7f0ec8237ff4
treed58e68ead9653298d5c38db18ea4838b07dcdf9e
parent5c4428f6391478ae983e1fcf7c42c832aa1a5e69
Fix integer underflow in ESDS processing

Several arithmetic operations within parseESDescriptor could underflow, leading
to an out-of-bounds read operation. Ensure that subtractions from 'size' do not
cause it to wrap around.

Bug: 20139950
Change-Id: I0d1b136ce68fd7c6f606ce66714bf644cfb2961c
(cherry picked from commit 07c0f59d6c48874982d2b5c713487612e5af465a)
media/libstagefright/ESDS.cpp