commit 5ff4bb7a65f0495c2cd79413ef3001b208ae7e2c
author Abhishek Arya <aarya@google.com> Tue Aug 18 16:33:50 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Tue Aug 18 16:33:50 2015 +0000
tree 8aaaf7a1f0b4170e32c60a0c87c6d2c16870c6fe
parent 3b77e940822e8a5ef4953b709bdae00fa1bcca43
parent 8026ad3838e2f7367e8ff616f66b2c2f8bc8488c

am 8026ad38: am 6efa86be: Merge "Check vector size before accessing" into klp-dev

* commit '8026ad3838e2f7367e8ff616f66b2c2f8bc8488c':
  Check vector size before accessing

media/libstagefright/MPEG4Extractor.cpp

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 388f785..54c8eab 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -3355,8 +3355,17 @@
     int ivlength;
     CHECK(mFormat->findInt32(kKeyCryptoDefaultIVSize, &ivlength));
 
+    // only 0, 8 and 16 byte initialization vectors are supported
+    if (ivlength != 0 && ivlength != 8 && ivlength != 16) {
+        ALOGW("unsupported IV length: %d", ivlength);
+        return ERROR_MALFORMED;
+    }
     // read CencSampleAuxiliaryDataFormats
     for (size_t i = 0; i < mCurrentSampleInfoCount; i++) {
+        if (i >= mCurrentSamples.size()) {
+            ALOGW("too few samples");
+            break;
+        }
         Sample *smpl = &mCurrentSamples.editItemAt(i);
 
         memset(smpl->iv, 0, 16);