From 006d9021fc6c7ed492eda25d5e9ac1fb0b11a17b Mon Sep 17 00:00:00 2001 From: "Joshua J. Drake" Date: Wed, 8 Apr 2015 23:23:55 -0500 Subject: Fix several ineffective integer overflow checks Commit edd4a76 (which addressed bugs 15328708, 15342615, 15342751) added several integer overflow checks. Unfortunately, those checks fail to take into account integer promotion rules and are thus themselves subject to an integer overflow. Cast the sizeof() operator to a uint64_t to force promotion while multiplying. Bug: 20139950 Change-Id: I2e70584ab566dbaa2fba4df6ca7a89b348ae9a06 Signed-off-by: Joshua J. Drake Tested-by: Moritz Bandemer --- media/libstagefright/SampleTable.cpp | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/media/libstagefright/SampleTable.cpp b/media/libstagefright/SampleTable.cpp index 4a42a70..3df0d7e 100644 --- a/media/libstagefright/SampleTable.cpp +++ b/media/libstagefright/SampleTable.cpp @@ -330,6 +330,10 @@ status_t SampleTable::setTimeToSampleParams( } mTimeToSampleCount = U32_AT(&header[4]); + uint64_t allocSize = mTimeToSampleCount * 2 * (uint64_t)sizeof(uint32_t); + if (allocSize > SIZE_MAX) { + return ERROR_OUT_OF_RANGE; + } mTimeToSample = new uint32_t[mTimeToSampleCount * 2]; size_t size = sizeof(uint32_t) * mTimeToSampleCount * 2; @@ -373,6 +377,10 @@ status_t SampleTable::setCompositionTimeToSampleParams( } mNumCompositionTimeDeltaEntries = numEntries; + uint64_t allocSize = numEntries * 2 * (uint64_t)sizeof(uint32_t); + if (allocSize > SIZE_MAX) { + return ERROR_OUT_OF_RANGE; + } mCompositionTimeDeltaEntries = new uint32_t[2 * numEntries]; if (mDataSource->readAt( @@ -418,6 +426,11 @@ status_t SampleTable::setSyncSampleParams(off64_t data_offset, size_t data_size) ALOGV("Table of sync samples is empty or has only a single entry!"); } + uint64_t allocSize = mNumSyncSamples * (uint64_t)sizeof(uint32_t); + if (allocSize > SIZE_MAX) { + return ERROR_OUT_OF_RANGE; + } + mSyncSamples = new uint32_t[mNumSyncSamples]; size_t size = mNumSyncSamples * sizeof(uint32_t); if (mDataSource->readAt(mSyncSampleOffset + 8, mSyncSamples, size) -- cgit v1.1