commit 6221b5465842be9f46794bc9f19749e757f96b84
author Dongwon Kang <dwkang@google.com> Mon Jun 12 12:58:58 2017 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Wed Aug 02 17:37:44 2017 +0000
tree 6133800e0d7da7f46ece8a9d173fc9b51b19c64e
parent 96e7917b6aa7c8eeb999afffead4dd284c4c060f

MPEG4Extractor: check size for yrrc box

Test: stagefright -s poc_file
Bug: 62133227
Change-Id: Iafefac39764ce01b4dde414b9f152c9ea71810e9
(cherry picked from commit 6ace94d2952eac82fc4c86aa6d585258248bf18c)

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 5441714..d014b2a 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -2984,6 +2984,13 @@
         }
         case FOURCC('y', 'r', 'r', 'c'):
         {
+            if (size < 6) {
+                delete[] buffer;
+                buffer = NULL;
+                ALOGE("b/62133227");
+                android_errorWriteLog(0x534e4554, "62133227");
+                return ERROR_MALFORMED;
+            }
             char tmp[5];
             uint16_t year = U16_AT(&buffer[4]);
 
@@ -3006,6 +3013,8 @@
 
         // smallest possible valid UTF-16 string w BOM: 0xfe 0xff 0x00 0x00
         if (size < 6) {
+            delete[] buffer;
+            buffer = NULL;
             return ERROR_MALFORMED;
         }