commit fe84c20143f95ad1d4e0203a6a11abb772efdef0
author Marco Nelissen <marcone@google.com> Tue Jan 12 12:37:36 2016 -0800
committer The Android Automerger <android-build@google.com> Fri Jan 22 14:44:19 2016 -0800
tree 72dd8e6b815413d22330d8f01d714427698ed5c7
parent b862285d2ac905c2a4845335d6a68a55135f6260

Fix out-of-bounds write

Bug: 26365349
Change-Id: Ia363d9f8c231cf255dea852e0bbf5ca466c7990b

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 78448c7..6fcc095 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -4294,7 +4294,15 @@
                     continue;
                 }
 
-                CHECK(dstOffset + 4 <= mBuffer->size());
+                if (dstOffset > SIZE_MAX - 4 ||
+                        dstOffset + 4 > SIZE_MAX - nalLength ||
+                        dstOffset + 4 + nalLength > mBuffer->size()) {
+                    ALOGE("b/26365349 : %zu %zu", dstOffset, mBuffer->size());
+                    android_errorWriteLog(0x534e4554, "26365349");
+                    mBuffer->release();
+                    mBuffer = NULL;
+                    return ERROR_MALFORMED;
+                }
 
                 dstData[dstOffset++] = 0;
                 dstData[dstOffset++] = 0;