commit 738a753a3ca7bf8f9f608ca941575626265294e4
author Wei Jia <wjia@google.com> Thu Jun 04 10:40:23 2015 -0700
committer Nick Kralevich <nnk@google.com> Mon Aug 03 22:31:21 2015 -0700
tree d8019528abfe7586e10e83e79b251bd1a1975ff8
parent 4dd7cb699f49b56f94a32080fdac7f0ec8237ff4

SampleTable: fix integer overflow checks.

Bug: 20139950
Bug: 22935234
(cherry picked from commit a105482ae577852ffd08ce88ae5d1ba81db875ac)

Change-Id: I408d261de1a6dd5c4343bcf3a7dfd8a259e0e2f3

media/libstagefright/SampleTable.cpp

diff --git a/media/libstagefright/SampleTable.cpp b/media/libstagefright/SampleTable.cpp
index a7ceecb..52ce82b 100644
--- a/media/libstagefright/SampleTable.cpp
+++ b/media/libstagefright/SampleTable.cpp
@@ -333,7 +333,7 @@
     }
 
     mTimeToSampleCount = U32_AT(&header[4]);
-    uint64_t allocSize = mTimeToSampleCount * 2 * (uint64_t)sizeof(uint32_t);
+    uint64_t allocSize = (uint64_t)mTimeToSampleCount * 2 * sizeof(uint32_t);
     if (allocSize > SIZE_MAX) {
         return ERROR_OUT_OF_RANGE;
     }
@@ -379,7 +379,7 @@
     }
 
     mNumCompositionTimeDeltaEntries = numEntries;
-    uint64_t allocSize = numEntries * 2 * (uint64_t)sizeof(uint32_t);
+    uint64_t allocSize = (uint64_t)numEntries * 2 * sizeof(uint32_t);
     if (allocSize > SIZE_MAX) {
         return ERROR_OUT_OF_RANGE;
     }