Skip to content
Permalink
Browse files

Fix integer overflow during MP4 atom processing

A few sample table related FourCC values are handled by the
setSampleToChunkParams function. An integer overflow exists within this
function. Validate that mNumSampleToChunkOffets will not cause an integer
overflow.

Bug: 20139950

(cherry picked from commit c24607c)

Change-Id: I49086952451b09a234d8b82669251ab9f1ef58d9
  • Loading branch information...
jduck authored and andi34 committed Apr 9, 2015
1 parent ff687ba commit 3701ee413c5ca0de838fd74cbfb3fb0f847665ac
Showing with 3 additions and 0 deletions.
  1. +3 −0 media/libstagefright/SampleTable.cpp
@@ -230,6 +230,9 @@ status_t SampleTable::setSampleToChunkParams(
return ERROR_MALFORMED;
}

if (SIZE_MAX / sizeof(SampleToChunkEntry) <= mNumSampleToChunkOffsets)
return ERROR_OUT_OF_RANGE;

mSampleToChunkEntries =
new SampleToChunkEntry[mNumSampleToChunkOffsets];

0 comments on commit 3701ee4

Please sign in to comment.
You can’t perform that action at this time.