tree 77ffbf80f70564edf443ce788c501567c5caecc6
parent 7c6f217fe717b3287c17bf75983843efad4885c2
author Joshua J. Drake <android-open-source@qoop.org> 1430782148 -0500
committer Jon Larimer <jlarimer@google.com> 1438369493 -0400

Fix integer overflow when handling MPEG4 tx3g atom

When the sum of the 'size' and 'chunk_size' variables is larger than 2^32,
an integer overflow occurs. Using the result value to allocate memory
leads to an undersized buffer allocation and later a potentially
exploitable heap corruption condition. Ensure that integer overflow does
not occur.

Bug: 20923261
Change-Id: Id050a36b33196864bdd98b5ea24241f95a0b5d1f