commit c114eee1749987da02a106d0080faeffc4d0a81c
author Wei Jia <wjia@google.com> Mon Sep 28 14:50:47 2015 -0700
committer The Android Automerger <android-build@google.com> Tue Oct 27 15:22:08 2015 -0700
tree 35bfa99460fc7d7a149a19824900a473515742b8
parent a55d21ed6ac9769885489398965f01fc7b69bd2f

MPEG4Extractor: ensure buffer size is not less than 8 for LastCommentData.

Bug: 24346430
Change-Id: I897a724e968841d9160f819d06c0ce22f6d743c4

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 38ae6f3..4e12c07 100755
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -2564,6 +2564,12 @@
                     mLastCommentName.setTo((const char *)buffer + 4);
                     break;
                 case FOURCC('d', 'a', 't', 'a'):
+                    if (size < 8) {
+                        delete[] buffer;
+                        buffer = NULL;
+                        ALOGE("b/24346430");
+                        return ERROR_MALFORMED;
+                    }
                     mLastCommentData.setTo((const char *)buffer + 8);
                     break;
             }