commit a2d1d85726aa2a3126e9c331a8e00a8c319c9e2b
author Robert Shih <robertshih@google.com> Fri Mar 18 14:34:57 2016 -0700
committer The Android Automerger <android-build@google.com> Fri Mar 25 17:46:45 2016 -0700
tree aa3d06685b76e6bac9056e4c56aa8bea3c58ae2b
parent b04aee833c5cfb6b31b8558350feb14bb1a0f353

NuPlayerStreamListener: NULL and bounds check before memcpy

Bug: 27533704
Change-Id: I992a7709b92b1cbc3114c97bec48a3fc5b22ba6e

media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp

diff --git a/media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp b/media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp
index f53afbd..ee70306 100644
--- a/media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp
+++ b/media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp
@@ -144,8 +144,17 @@
         copy = size;
     }
 
+    if (entry->mIndex >= mBuffers.size()) {
+        return ERROR_MALFORMED;
+    }
+
+    sp<IMemory> mem = mBuffers.editItemAt(entry->mIndex);
+    if (mem == NULL || mem->size() < copy || mem->size() - copy < entry->mOffset) {
+        return ERROR_MALFORMED;
+    }
+
     memcpy(data,
-           (const uint8_t *)mBuffers.editItemAt(entry->mIndex)->pointer()
+           (const uint8_t *)mem->pointer()
             + entry->mOffset,
            copy);