From 5c134e6b2047b10877f02a46f4bb293537269f00 Mon Sep 17 00:00:00 2001 From: "Joshua J. Drake" Date: Wed, 8 Apr 2015 23:44:57 -0500 Subject: [PATCH] Fix integer overflow during MP4 atom processing A few sample table related FourCC values are handled by the setSampleToChunkParams function. An integer overflow exists within this function. Validate that mNumSampleToChunkOffets will not cause an integer overflow. Bug: 20139950 (cherry picked from commit c24607c29c96f939aed9e33bfa702b1dd79da4b7) Change-Id: I49086952451b09a234d8b82669251ab9f1ef58d9 --- media/libstagefright/SampleTable.cpp | 3 +++ 1 file changed, 3 insertions(+) diff --git a/media/libstagefright/SampleTable.cpp b/media/libstagefright/SampleTable.cpp index 8dfa365bd4..4d8d703023 100644 --- a/media/libstagefright/SampleTable.cpp +++ b/media/libstagefright/SampleTable.cpp @@ -230,6 +230,9 @@ status_t SampleTable::setSampleToChunkParams( return ERROR_MALFORMED; } + if (SIZE_MAX / sizeof(SampleToChunkEntry) <= mNumSampleToChunkOffsets) + return ERROR_OUT_OF_RANGE; + mSampleToChunkEntries = new SampleToChunkEntry[mNumSampleToChunkOffsets]; -- 2.11.0