From c40f2dc30a7e33526460750e43325a947845b4fb Mon Sep 17 00:00:00 2001 From: "Joshua J. Drake" Date: Mon, 4 May 2015 18:36:35 -0500 Subject: Prevent integer overflow when processing covr MPEG4 atoms If the 'chunk_data_size' value is SIZE_MAX, an integer overflow will occur and cause an undersized buffer to be allocated. The following processing then overfills the resulting memory and creates a potentially exploitable condition. Ensure that integer overflow does not occur. Bug: 20923261 Change-Id: I75cce323aec04a612e5a230ecd7c2077ce06035f Signed-off-by: Joshua J. Drake Tested-by: Moritz Bandemer --- media/libstagefright/MPEG4Extractor.cpp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index 92135ea..0c6f74c 100644 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -1529,7 +1529,11 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { { if (mFileMetaData != NULL) { ALOGV("chunk_data_size = %lld and data_offset = %lld", - chunk_data_size, data_offset); + (long long)chunk_data_size, (long long)data_offset); + + if (chunk_data_size >= SIZE_MAX - 1) { + return ERROR_MALFORMED; + } uint8_t *buffer = new uint8_t[chunk_data_size + 1]; if (mDataSource->readAt( data_offset, buffer, chunk_data_size) != (ssize_t)chunk_data_size) { -- cgit v1.1