commit 108cd2dc8df55f3f2ecdfbb4bb0ae981a74b6860
author Wei Jia <wjia@google.com> Tue Aug 18 11:17:24 2015 -0700
committer Wei Jia <wjia@google.com> Wed Aug 19 11:48:19 2015 -0700
tree 86860e2d3f5c7373f0e03a82c8deb5ee22f38a77
parent 916a9684295fb578f4b3c6c16b621ef201a49964

libstagefright: fix handling of mSampleTimeEntries and mNumSampleSizes in SampleTable.

Bug: 23247055
Change-Id: I29ef59c7ff09248063714e5013f7c33f66c5eebd
(cherry picked from commit 3564c4562f46bede6ef1ea716c4fd4f77e470ae8)

media/libstagefright/SampleTable.cpp

diff --git a/media/libstagefright/SampleTable.cpp b/media/libstagefright/SampleTable.cpp
index 52ce82b..116f358 100644
--- a/media/libstagefright/SampleTable.cpp
+++ b/media/libstagefright/SampleTable.cpp
@@ -27,6 +27,11 @@
 #include <media/stagefright/DataSource.h>
 #include <media/stagefright/Utils.h>
 
+/* TODO: remove after being merged into other branches */
+#ifndef UINT32_MAX
+#define UINT32_MAX       (4294967295U)
+#endif
+
 namespace android {
 
 // static
@@ -282,6 +287,9 @@
 
     mDefaultSampleSize = U32_AT(&header[4]);
     mNumSampleSizes = U32_AT(&header[8]);
+    if (mNumSampleSizes > (UINT32_MAX - 12) / 16) {
+        return ERROR_MALFORMED;
+    }
 
     if (type == kSampleSizeType32) {
         mSampleSizeFieldSize = 32;
@@ -498,7 +506,7 @@
 void SampleTable::buildSampleEntriesTable() {
     Mutex::Autolock autoLock(mLock);
 
-    if (mSampleTimeEntries != NULL) {
+    if (mSampleTimeEntries != NULL || mNumSampleSizes == 0) {
         return;
     }
 
@@ -540,6 +548,10 @@
         uint32_t req_time, uint32_t *sample_index, uint32_t flags) {
     buildSampleEntriesTable();
 
+    if (mSampleTimeEntries == NULL) {
+        return ERROR_OUT_OF_RANGE;
+    }
+
     uint32_t left = 0;
     uint32_t right = mNumSampleSizes;
     while (left < right) {