commit a0c1eb865fba7ef3e838e4645effab0df21e8ee0
author Marco Nelissen <marcone@google.com> Tue Feb 07 21:50:23 2017 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Tue Feb 07 21:50:24 2017 +0000
tree b693b7133e35e12ba88b3cf3c69f9138f6451f44
parent e4dbaeffd766d8a240d545a74ce6280860467512
parent 833fb390dcdfa4da31640dd3210e568d141960c4

Merge "Fix potential overflows"

media/libstagefright/SampleIterator.cpp

diff --git a/media/libstagefright/SampleIterator.cpp b/media/libstagefright/SampleIterator.cpp
index 54c9fa3..8ddf7f3 100644
--- a/media/libstagefright/SampleIterator.cpp
+++ b/media/libstagefright/SampleIterator.cpp
@@ -305,8 +305,16 @@
         return ERROR_OUT_OF_RANGE;
     }
 
-    while (sampleIndex >= mTTSSampleIndex + mTTSCount) {
-        if (mTimeToSampleIndex == mTable->mTimeToSampleCount) {
+    while (true) {
+        if (mTTSSampleIndex > UINT32_MAX - mTTSCount) {
+            return ERROR_OUT_OF_RANGE;
+        }
+        if(sampleIndex < mTTSSampleIndex + mTTSCount) {
+            break;
+        }
+        if (mTimeToSampleIndex == mTable->mTimeToSampleCount ||
+            mTTSCount > UINT32_MAX / mTTSDuration ||
+            mTTSSampleTime > UINT32_MAX - (mTTSCount * mTTSDuration)) {
             return ERROR_OUT_OF_RANGE;
         }