Skip to content

Commit afcaff4

Browse files
jduckandi34
authored andcommitted
Fix several ineffective integer overflow checks
Commit edd4a76 (which addressed bugs 15328708, 15342615, 15342751) added several integer overflow checks. Unfortunately, those checks fail to take into account integer promotion rules and are thus themselves subject to an integer overflow. Cast the sizeof() operator to a uint64_t to force promotion while multiplying. Bug: 20139950 (cherry picked from commit e2e812e) Change-Id: I080eb3fa147601f18cedab86e0360406c3963d7b
1 parent 3e66cda commit afcaff4

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

media/libstagefright/SampleTable.cpp

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -333,7 +333,7 @@ status_t SampleTable::setTimeToSampleParams(
333333
}
334334

335335
mTimeToSampleCount = U32_AT(&header[4]);
336-
uint64_t allocSize = mTimeToSampleCount * 2 * sizeof(uint32_t);
336+
uint64_t allocSize = mTimeToSampleCount * 2 * (uint64_t)sizeof(uint32_t);
337337
if (allocSize > SIZE_MAX) {
338338
return ERROR_OUT_OF_RANGE;
339339
}
@@ -379,7 +379,7 @@ status_t SampleTable::setCompositionTimeToSampleParams(
379379
}
380380

381381
mNumCompositionTimeDeltaEntries = numEntries;
382-
uint64_t allocSize = numEntries * 2 * sizeof(uint32_t);
382+
uint64_t allocSize = numEntries * 2 * (uint64_t)sizeof(uint32_t);
383383
if (allocSize > SIZE_MAX) {
384384
return ERROR_OUT_OF_RANGE;
385385
}
@@ -429,7 +429,7 @@ status_t SampleTable::setSyncSampleParams(off64_t data_offset, size_t data_size)
429429
ALOGV("Table of sync samples is empty or has only a single entry!");
430430
}
431431

432-
uint64_t allocSize = mNumSyncSamples * sizeof(uint32_t);
432+
uint64_t allocSize = mNumSyncSamples * (uint64_t)sizeof(uint32_t);
433433
if (allocSize > SIZE_MAX) {
434434
return ERROR_OUT_OF_RANGE;
435435
}

0 commit comments

Comments
 (0)