diff options
| author | Nick Kralevich <nnk@google.com> | 2015-05-08 02:49:24 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2015-05-08 02:49:24 +0000 |
| commit | 22bd7a63667893255b7b7714246084d0cf654cb8 (patch) | |
| tree | d69d50292e6e5a481cc0e92b6046df9e052bd047 /media | |
| parent | 2a834fc09e1b22e7f70250c55ae2f462f5f60987 (diff) | |
| parent | 5cea0155cfc41f67e91343c342f44251c03fde3a (diff) | |
| download | frameworks_av-22bd7a63667893255b7b7714246084d0cf654cb8.zip frameworks_av-22bd7a63667893255b7b7714246084d0cf654cb8.tar.gz frameworks_av-22bd7a63667893255b7b7714246084d0cf654cb8.tar.bz2 | |
Merge "Prevent reading past the end of the buffer in 3GPP" into mnc-dev
Diffstat (limited to 'media')
| -rw-r--r-- | media/libstagefright/MPEG4Extractor.cpp | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index 6573afc..1f1d751 100644 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -2605,11 +2605,11 @@ status_t MPEG4Extractor::parseITunesMetaData(off64_t offset, size_t size) { } status_t MPEG4Extractor::parse3GPPMetaData(off64_t offset, size_t size, int depth) { - if (size < 4) { + if (size < 4 || size == SIZE_MAX) { return ERROR_MALFORMED; } - uint8_t *buffer = new (std::nothrow) uint8_t[size]; + uint8_t *buffer = new (std::nothrow) uint8_t[size + 1]; if (buffer == NULL) { return ERROR_MALFORMED; } @@ -2701,6 +2701,7 @@ status_t MPEG4Extractor::parse3GPPMetaData(off64_t offset, size_t size, int dept } if (isUTF8) { + buffer[size] = 0; mFileMetaData->setCString(metadataKey, (const char *)buffer + 6); } else { // Convert from UTF-16 string to UTF-8 string. |