commit 4f5bb1e6998d068a44fd562f47820fe5d6ef5067
author Andreas Huber <andih@google.com> Thu Sep 16 14:54:10 2010 -0700
committer Andreas Huber <andih@google.com> Thu Sep 16 14:54:10 2010 -0700
tree 9edca42f22b867c080708cb4de0ad4d4bf01e9bf
parent 8946ab2618a4eebfdf7b00c6b68e6a5d8432cafa

Make sure the .wav extractor does not read data outside the bounds of the 'data' box.

Change-Id: Icf18f9224d97e6a78328dd429ebc3a3433e5cecd
related-to-bug: 3007790

media/libstagefright/WAVExtractor.cpp

diff --git a/media/libstagefright/WAVExtractor.cpp b/media/libstagefright/WAVExtractor.cpp
index 57c1075..aff06bc 100644
--- a/media/libstagefright/WAVExtractor.cpp
+++ b/media/libstagefright/WAVExtractor.cpp
@@ -331,9 +331,20 @@
         return err;
     }
 
+    size_t maxBytesToRead =
+        mBitsPerSample == 8 ? kMaxFrameSize / 2 : kMaxFrameSize;
+
+    size_t maxBytesAvailable =
+        (mCurrentPos - mOffset >= (off_t)mSize)
+            ? 0 : mSize - (mCurrentPos - mOffset);
+
+    if (maxBytesToRead > maxBytesAvailable) {
+        maxBytesToRead = maxBytesAvailable;
+    }
+
     ssize_t n = mDataSource->readAt(
             mCurrentPos, buffer->data(),
-            mBitsPerSample == 8 ? kMaxFrameSize / 2 : kMaxFrameSize);
+            maxBytesToRead);
 
     if (n <= 0) {
         buffer->release();