commit 115e995c6b3fe7ed33e2d5d88872cb87ab4e63f0
author Wei Jia <wjia@google.com> Fri Jun 05 17:43:52 2015 -0700
committer Wei Jia <wjia@google.com> Fri Jun 05 17:43:52 2015 -0700
tree 72ae084b486e49065520332b3a43ff4c3a3f75ef
parent 768a8fb4c05f524c802f8e97c9e07b73d1a196ff
parent 1f44d837a9273dc86bf0c928c2ead313d71d1464

resolved conflicts for merge of 1f44d837 to lmp-dev

Change-Id: Id60c2470ec2afebdbc1c0c995b90e294c9c879eb

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 5a86aac..00af00b 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -1890,6 +1890,10 @@
                 size = 0;
             }
 
+            if (SIZE_MAX - chunk_size <= size) {
+                return ERROR_MALFORMED;
+            }
+
             uint8_t *buffer = new (std::nothrow) uint8_t[size + chunk_size];
             if (buffer == NULL) {
                 return ERROR_MALFORMED;