commit 2b50b7aa7d16014ccf35db7a7b4b5e84f7b4027c
author Nick Kralevich <nnk@google.com> Mon Aug 03 15:44:45 2015 -0700
committer Nick Kralevich <nnk@google.com> Fri Aug 07 08:42:20 2015 -0700
tree b7c14e40bf928460c7459921bbd86ee33a44f111
parent 70fb7a5dbbb112b13298a74547eb0bf0be9bcb6b

MPEG4Extractor.cpp: Add check for size == SIZE_MAX

If size == SIZE_MAX, the line:

  uint8_t *buffer = new (std::nothrow) uint8_t[size + 1];

ends up allocating zero bytes, which is obviously incorrect.

(cherrypicked from commit b2d33aee5122c91a59c2a676c0b89ad340232450)

Change-Id: I7d44a66b67c590041572e25d1fbd1de94401a77f

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index f76bc53..5fab865 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -2289,7 +2289,7 @@
 }
 
 status_t MPEG4Extractor::parseITunesMetaData(off64_t offset, size_t size) {
-    if (size < 4) {
+    if (size < 4 || size == SIZE_MAX) {
         return ERROR_MALFORMED;
     }