commit 86fa6dc2cb9a9022c953d77de3a65fe7e9ea481a
author Vignesh Venkatasubramanian <vigneshv@google.com> Fri Aug 25 11:28:01 2017 -0700
committer Vignesh Venkatasubramanian <vigneshv@google.com> Fri Aug 25 11:28:01 2017 -0700
tree 3859effcb0f34515ec0edeca4ae6d789a64c1e47
parent 245e7a258ab52bab589940ef9038bbe153a2c5a1

mkvparser: Fix potential overflow in Block::Parse

BUG=b/65045341

Change-Id: I198e72ea3859d2382a34e1e6dca957f9323af278

mkvparser/mkvparser.cc

diff --git a/mkvparser/mkvparser.cc b/mkvparser/mkvparser.cc
index 3f4878c..1eeaa13 100644
--- a/mkvparser/mkvparser.cc
+++ b/mkvparser/mkvparser.cc
@@ -7911,6 +7911,10 @@
         return E_FILE_FORMAT_INVALID;
 
       curr.len = static_cast<long>(frame_size);
+      // Check if size + curr.len could overflow.
+      if (size > LLONG_MAX - curr.len) {
+        return E_FILE_FORMAT_INVALID;
+      }
       size += curr.len;  // contribution of this frame
 
       --frame_count;