commit 8d881928a0e8ae1109bd817bd0b372b85ce57820
author Joshua J. Drake <android-open-source@qoop.org> Wed Apr 08 23:44:57 2015 -0500
committer The Android Automerger <android-build@android.com> Mon Jul 27 12:35:18 2015 -0700
tree 371ad6159b619a5dd91c7abab6ca70734f91c56c
parent 894c7bacd01a776b1d7a25a01f5b797158c65de3

Fix integer overflow during MP4 atom processing

A few sample table related FourCC values are handled by the
setSampleToChunkParams function. An integer overflow exists within this
function. Validate that mNumSampleToChunkOffets will not cause an integer
overflow.

Bug: 20139950

(cherry picked from commit c24607c29c96f939aed9e33bfa702b1dd79da4b7)

Change-Id: I49086952451b09a234d8b82669251ab9f1ef58d9

media/libstagefright/SampleTable.cpp

diff --git a/media/libstagefright/SampleTable.cpp b/media/libstagefright/SampleTable.cpp
index b572af3..6030236 100644
--- a/media/libstagefright/SampleTable.cpp
+++ b/media/libstagefright/SampleTable.cpp
@@ -230,6 +230,9 @@
         return ERROR_MALFORMED;
     }
 
+    if (SIZE_MAX / sizeof(SampleToChunkEntry) <= mNumSampleToChunkOffsets)
+        return ERROR_OUT_OF_RANGE;
+
     mSampleToChunkEntries =
         new SampleToChunkEntry[mNumSampleToChunkOffsets];