commit 3942f55f1c8e36b0f9d4c5acf99b177476f96457
author Ray Essick <essick@google.com> Wed Feb 02 13:33:50 2022 -0800
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Mon Feb 14 23:12:32 2022 +0000
tree e3ef9d01a0a1d3257781bc395126ea03a7bbc913
parent 4b93da988f02c652f3429661f9a9859fa1c1ea0a

Safe parsing of HEIF framecount information

Bug: 215002587
Test: POC described in bug
Change-Id: I92f8fdfe860cb360fb0ae099db3c92776ba7390f
(cherry picked from commit e89e632f9aa04e15291ee096b3152b40474a993d)
(cherry picked from commit 616bd340ecded759720199bcf5b8562e0fdf3f59)
Merged-In:I92f8fdfe860cb360fb0ae099db3c92776ba7390f

media/libheif/HeifDecoderImpl.cpp

diff --git a/media/libheif/HeifDecoderImpl.cpp b/media/libheif/HeifDecoderImpl.cpp
index 273d91c..4a96e7b 100644
--- a/media/libheif/HeifDecoderImpl.cpp
+++ b/media/libheif/HeifDecoderImpl.cpp
@@ -25,6 +25,7 @@
 #include <binder/IMemory.h>
 #include <binder/MemoryDealer.h>
 #include <drm/drm_framework_common.h>
+#include <log/log.h>
 #include <media/mediametadataretriever.h>
 #include <media/stagefright/MediaSource.h>
 #include <media/stagefright/foundation/ADebug.h>
@@ -421,7 +422,13 @@
 
         initFrameInfo(&mSequenceInfo, videoFrame);
 
-        mSequenceLength = atoi(mRetriever->extractMetadata(METADATA_KEY_VIDEO_FRAME_COUNT));
+        const char* frameCount = mRetriever->extractMetadata(METADATA_KEY_VIDEO_FRAME_COUNT);
+        if (frameCount == nullptr) {
+            android_errorWriteWithInfoLog(0x534e4554, "215002587", -1, NULL, 0);
+            ALOGD("No valid sequence information in metadata");
+            return false;
+        }
+        mSequenceLength = atoi(frameCount);
 
         if (defaultInfo == nullptr) {
             defaultInfo = &mSequenceInfo;