commit | 93ba37d2fe2cd952723419705e8223429ac8d3b0 | [log] [tgz] |
---|---|---|
author | Joshua J. Drake <android-open-source@qoop.org> | Mon May 04 18:29:08 2015 -0500 |
committer | The Android Automerger <android-build@android.com> | Mon Jul 27 12:38:01 2015 -0700 |
tree | de4b3adc9d7e35fd4473c8dc564e8b260cacae3f | |
parent | 6e7e30d4608c02a8869a71a3833f186dddc12896 [diff] |
Fix integer overflow when handling MPEG4 tx3g atom When the sum of the 'size' and 'chunk_size' variables is larger than 2^32, an integer overflow occurs. Using the result value to allocate memory leads to an undersized buffer allocation and later a potentially exploitable heap corruption condition. Ensure that integer overflow does not occur. Bug: 20923261 Change-Id: Id050a36b33196864bdd98b5ea24241f95a0b5d1f