commit 4a6f3d121c7a5fba2bf422b98d3022f6252afde8
author Marco Nelissen <marcone@google.com> Thu May 11 14:43:54 2017 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Wed May 31 20:26:16 2017 +0000
tree 54ad3570c9ae7bd78217f32bed443454c5fe4401
parent fc7c2b3b0c7a83858683689bc758928e4a7cfb1c

Check chunk size

to make sure we actually advance in the file

Bug: 37093318
Test: decoded poc and other files with and without change
Change-Id: I94cf65336ce4132c17c39b651dc520264f02a704
(cherry picked from commit f01750adb0558d1885c7d5a5c8900d2187d0d38d)

arm-wt-22k/lib_src/eas_mdls.c

diff --git a/arm-wt-22k/lib_src/eas_mdls.c b/arm-wt-22k/lib_src/eas_mdls.c
index 296d783..8097ba4 100644
--- a/arm-wt-22k/lib_src/eas_mdls.c
+++ b/arm-wt-22k/lib_src/eas_mdls.c
@@ -785,6 +785,11 @@
     if ((result = EAS_HWGetDWord(pDLSData->hwInstData, pDLSData->fileHandle, pSize, EAS_FALSE)) != EAS_SUCCESS)
         return result;
 
+    if (*pSize < 0) {
+        ALOGE("b/37093318");
+        return EAS_ERROR_FILE_FORMAT;
+    }
+
     /* get form type for RIFF and LIST types */
     if ((*pChunkType == CHUNK_RIFF) || (*pChunkType == CHUNK_LIST))
     {