commit 0e33cb2dd5ccf6f4db8c694cb2c233bb1d2a2d0b
author Joshua J. Drake <android-open-source@qoop.org> Tue Aug 04 21:31:51 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Tue Aug 04 21:31:51 2015 +0000
tree 1afc0506d1f7fa8de63d0b4263f2427559501b3c
parent fd334e346bd0fc9b11756539d1635eabdb6b04cb
parent e4ccf3a14beabfeeb6c7df47ae118f3db999c1ce

am e4ccf3a1: am 3329a19b: am c87faed6: Fix integer underflow in covr MPEG4 processing

* commit 'e4ccf3a14beabfeeb6c7df47ae118f3db999c1ce':
  Fix integer underflow in covr MPEG4 processing

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index ec6ca16..ae324d9 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -1445,6 +1445,10 @@
                     return ERROR_IO;
                 }
                 const int kSkipBytesOfDataBox = 16;
+                if (chunk_data_size <= kSkipBytesOfDataBox) {
+                    return ERROR_MALFORMED;
+                }
+
                 mFileMetaData->setData(
                     kKeyAlbumArt, MetaData::TYPE_NONE,
                     buffer + kSkipBytesOfDataBox, chunk_data_size - kSkipBytesOfDataBox);