commit 6004bf7e12008c30e50454ebad911626f7ca8dd8
author Nick Kralevich <nnk@google.com> Mon Aug 03 15:44:45 2015 -0700
committer The Android Automerger <android-build@android.com> Tue Sep 01 19:11:19 2015 -0700
tree 7aec14c088bcba2f09d8a01835aec1f51d0097ed
parent 4d88d40f6b29d028cf1b60549fb1d78a3f1f496b

MPEG4Extractor.cpp: Add check for size == SIZE_MAX

If size == SIZE_MAX, the line:

  uint8_t *buffer = new (std::nothrow) uint8_t[size + 1];

ends up allocating zero bytes, which is obviously incorrect.

(cherry picked from commit b2d33aee5122c91a59c2a676c0b89ad340232450)

Bug: 23031033
Change-Id: I8027247a4e24d2c8a8b4eac88c3643eccda108b9

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index c07a8ea..eee8cb3 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -2232,7 +2232,7 @@
 }
 
 status_t MPEG4Extractor::parseITunesMetaData(off64_t offset, size_t size) {
-    if (size < 4) {
+    if (size < 4 || size == SIZE_MAX) {
         return ERROR_MALFORMED;
     }