commit 8a1a5d17ddc3ff902a9d9e1858713ed9406c45c8
author Jon Larimer <jlarimer@google.com> Tue Aug 18 18:20:27 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Tue Aug 18 18:20:27 2015 +0000
tree b1d9ae6ea6ef261034a0935b0f2b491e76cdae17
parent 698ff79c1e37f01678231eb4f57dc8f6574a7f83
parent 9707195bf18fed1318e5c747db82f9783262a137

am 9707195b: am f97b6bee: Merge "Check integer overflow to prevent memory corruption" into klp-dev

* commit '9707195bf18fed1318e5c747db82f9783262a137':
  Check integer overflow to prevent memory corruption

media/libstagefright/DRMExtractor.cpp

diff --git a/media/libstagefright/DRMExtractor.cpp b/media/libstagefright/DRMExtractor.cpp
index 63cb430..9cb6e86 100644
--- a/media/libstagefright/DRMExtractor.cpp
+++ b/media/libstagefright/DRMExtractor.cpp
@@ -186,7 +186,8 @@
 
             srcOffset += mNALLengthSize;
 
-            if (srcOffset + nalLength > len) {
+            size_t end = srcOffset + nalLength;
+            if (end > len || end < srcOffset) {
                 if (decryptedDrmBuffer.data) {
                     delete [] decryptedDrmBuffer.data;
                     decryptedDrmBuffer.data = NULL;