commit 25d3eb576ca166b23ff294595e9efedc3a6923c8
author TreeHugger Robot <treehugger-gerrit@google.com> Wed Jan 16 22:14:41 2019 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Wed Jan 16 22:14:41 2019 +0000
tree 6c145c46511d71e35fddd43d9e6d09ab11780285
parent 5fd6ad72852fb723ddc4783abd6b9138357b3e12
parent 9b248b8791dbfbd9a4ee80ddad9edc94c32e072e

Merge "Fix a potential integer overflow in MediaBuffer"

media/libstagefright/foundation/MediaBuffer.cpp

diff --git a/media/libstagefright/foundation/MediaBuffer.cpp b/media/libstagefright/foundation/MediaBuffer.cpp
index bab3a03..9beac05 100644
--- a/media/libstagefright/foundation/MediaBuffer.cpp
+++ b/media/libstagefright/foundation/MediaBuffer.cpp
@@ -59,9 +59,11 @@
 #ifndef NO_IMEMORY
     } else {
         ALOGV("creating memoryDealer");
-        sp<MemoryDealer> memoryDealer =
-                new MemoryDealer(size + sizeof(SharedControl), "MediaBuffer");
-        mMemory = memoryDealer->allocate(size + sizeof(SharedControl));
+        size_t newSize = 0;
+        if (!__builtin_add_overflow(size, sizeof(SharedControl), &newSize)) {
+            sp<MemoryDealer> memoryDealer = new MemoryDealer(newSize, "MediaBuffer");
+            mMemory = memoryDealer->allocate(newSize);
+        }
         if (mMemory == NULL) {
             ALOGW("Failed to allocate shared memory, trying regular allocation!");
             mData = malloc(size);