Check chunk size to make sure we actually advance in the file Bug: 37093318 Test: decoded poc and other files with and without change Change-Id: I94cf65336ce4132c17c39b651dc520264f02a704 (cherry picked from commit f01750adb0558d1885c7d5a5c8900d2187d0d38d)
diff --git a/arm-wt-22k/lib_src/eas_mdls.c b/arm-wt-22k/lib_src/eas_mdls.c index 296d783..8097ba4 100644 --- a/arm-wt-22k/lib_src/eas_mdls.c +++ b/arm-wt-22k/lib_src/eas_mdls.c
@@ -785,6 +785,11 @@ if ((result = EAS_HWGetDWord(pDLSData->hwInstData, pDLSData->fileHandle, pSize, EAS_FALSE)) != EAS_SUCCESS) return result; + if (*pSize < 0) { + ALOGE("b/37093318"); + return EAS_ERROR_FILE_FORMAT; + } + /* get form type for RIFF and LIST types */ if ((*pChunkType == CHUNK_RIFF) || (*pChunkType == CHUNK_LIST)) {