commit | 4dd7cb699f49b56f94a32080fdac7f0ec8237ff4 | [log] [tgz] |
---|---|---|
author | Joshua J. Drake <android-open-source@qoop.org> | Wed Apr 08 23:53:10 2015 -0500 |
committer | Nick Kralevich <nnk@google.com> | Mon Aug 03 16:23:20 2015 -0700 |
tree | d58e68ead9653298d5c38db18ea4838b07dcdf9e | |
parent | 5c4428f6391478ae983e1fcf7c42c832aa1a5e69 [diff] |
Fix integer underflow in ESDS processing Several arithmetic operations within parseESDescriptor could underflow, leading to an out-of-bounds read operation. Ensure that subtractions from 'size' do not cause it to wrap around. Bug: 20139950 Change-Id: I0d1b136ce68fd7c6f606ce66714bf644cfb2961c (cherry picked from commit 07c0f59d6c48874982d2b5c713487612e5af465a)