commit ac7cb990cc4c8a59a945ce36e5702e0adb213db4
author Joshua J. Drake <android-open-source@qoop.org> Tue Aug 04 03:35:37 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Tue Aug 04 03:35:37 2015 +0000
tree 68d21f765b211b856cd1b8c435839ee13e711cc0
parent 134dc3110c401544e4d3a3a1deab1c131fb77720
parent b417986c3a3a6bb9ca33657385a3433ff54090b2

am b417986c: am d1c08d6b: am efa73c2e: am 2e24d091: am a59d5e66: am 8ef5da3d: am 4dd7cb69: Fix integer underflow in ESDS processing

* commit 'b417986c3a3a6bb9ca33657385a3433ff54090b2':
  Fix integer underflow in ESDS processing

media/libstagefright/ESDS.cpp

diff --git a/media/libstagefright/ESDS.cpp b/media/libstagefright/ESDS.cpp
index 4a0c35c..c76bc4a 100644
--- a/media/libstagefright/ESDS.cpp
+++ b/media/libstagefright/ESDS.cpp
@@ -136,6 +136,8 @@
     --size;
 
     if (streamDependenceFlag) {
+        if (size < 2)
+            return ERROR_MALFORMED;
         offset += 2;
         size -= 2;
     }
@@ -145,11 +147,15 @@
             return ERROR_MALFORMED;
         }
         unsigned URLlength = mData[offset];
+        if (URLlength >= size)
+            return ERROR_MALFORMED;
         offset += URLlength + 1;
         size -= URLlength + 1;
     }
 
     if (OCRstreamFlag) {
+        if (size < 2)
+            return ERROR_MALFORMED;
         offset += 2;
         size -= 2;