commit 000c4bb81f88e9f0faf8de184768e9ae421a187c
author Chong Zhang <chz@google.com> Thu Apr 19 10:59:17 2018 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Mon Jun 04 23:46:19 2018 +0000
tree 9d086f00d8f3e93d32fc838628691f24e737f7a6
parent df8b49cfd3d23f1c0f67177deeac4a0c263ba33a

Add minimum size check for ImageGrid atom

bug: 73927042
Change-Id: I25dc3aeabe95bd907a418b12b2d06f3691cb1b42
(cherry picked from commit ef75163eb891b5259c0f5c2fc20fca2a5a47b7b7)

media/libstagefright/ItemTable.cpp

diff --git a/media/libstagefright/ItemTable.cpp b/media/libstagefright/ItemTable.cpp
index f9ee1c4..f589f4f 100644
--- a/media/libstagefright/ItemTable.cpp
+++ b/media/libstagefright/ItemTable.cpp
@@ -1335,7 +1335,8 @@
         ALOGV("adding %s: itemId %d", image.isGrid() ? "grid" : "image", info.itemId);
 
         if (image.isGrid()) {
-            if (size > 12) {
+            // ImageGrid struct is at least 8-byte, at most 12-byte (if flags&1)
+            if (size < 8 || size > 12) {
                 return ERROR_MALFORMED;
             }
             uint8_t buf[12];