NuPlayer2CCDecoder: Add bound check before memcpy
Test: none
Bug: 111874331
Change-Id: I6764802e8e8afd7e970ee433741f73a9b3d366dd
diff --git a/media/libmediaplayer2/nuplayer2/NuPlayer2CCDecoder.cpp b/media/libmediaplayer2/nuplayer2/NuPlayer2CCDecoder.cpp
index e48e388..e215965 100644
--- a/media/libmediaplayer2/nuplayer2/NuPlayer2CCDecoder.cpp
+++ b/media/libmediaplayer2/nuplayer2/NuPlayer2CCDecoder.cpp
@@ -372,10 +372,16 @@
timeUs, mDTVCCPacket->data(), mDTVCCPacket->size());
mDTVCCPacket->setRange(0, 0);
}
+ if (mDTVCCPacket->size() + 2 > mDTVCCPacket->capacity()) {
+ return false;
+ }
memcpy(mDTVCCPacket->data() + mDTVCCPacket->size(), br.data(), 2);
mDTVCCPacket->setRange(0, mDTVCCPacket->size() + 2);
br.skipBits(16);
} else if (mDTVCCPacket->size() > 0 && cc_type == 2) {
+ if (mDTVCCPacket->size() + 2 > mDTVCCPacket->capacity()) {
+ return false;
+ }
memcpy(mDTVCCPacket->data() + mDTVCCPacket->size(), br.data(), 2);
mDTVCCPacket->setRange(0, mDTVCCPacket->size() + 2);
br.skipBits(16);
@@ -403,6 +409,9 @@
line21CCBuf = new ABuffer((cc_count - i) * sizeof(CCData));
line21CCBuf->setRange(0, 0);
}
+ if (line21CCBuf->size() + sizeof(cc) > line21CCBuf->capacity()) {
+ return false;
+ }
memcpy(line21CCBuf->data() + line21CCBuf->size(), &cc, sizeof(cc));
line21CCBuf->setRange(0, line21CCBuf->size() + sizeof(CCData));
}
@@ -464,6 +473,9 @@
size_t trackIndex = getTrackIndex(kTrackTypeCEA708, service_number, &trackAdded);
if (mSelectedTrack == (ssize_t)trackIndex) {
sp<ABuffer> ccPacket = new ABuffer(block_size);
+ if (ccPacket->capacity() == 0) {
+ return false;
+ }
memcpy(ccPacket->data(), br.data(), block_size);
mCCMap.add(timeUs, ccPacket);
}
@@ -527,10 +539,12 @@
ccBuf = new ABuffer(size);
ccBuf->setRange(0, 0);
- for (ssize_t i = 0; i <= index; ++i) {
- sp<ABuffer> buf = mCCMap.valueAt(i);
- memcpy(ccBuf->data() + ccBuf->size(), buf->data(), buf->size());
- ccBuf->setRange(0, ccBuf->size() + buf->size());
+ if (ccBuf->capacity() > 0) {
+ for (ssize_t i = 0; i <= index; ++i) {
+ sp<ABuffer> buf = mCCMap.valueAt(i);
+ memcpy(ccBuf->data() + ccBuf->size(), buf->data(), buf->size());
+ ccBuf->setRange(0, ccBuf->size() + buf->size());
+ }
}
}