commit a9879efa62e9c863c234b46510111859158ebb68
author Chong Zhang <chz@google.com> Thu May 10 12:32:50 2018 -0700
committer android-build-merger <android-build-merger@google.com> Thu May 10 12:32:50 2018 -0700
tree de88c26c7b217b809ef81605393a02ec4edd8c4b
parent f4a28339fff6af3696d540d2e6eccb2feb9ce658
parent 215185d3cdd359bb26f555b58cd173a4d1643329

Merge "Add minimum size check for ImageGrid atom" into oc-mr1-dev
am: 215185d3cd

Change-Id: Ib67681af2ecda9aeb8f54609779316eac0abfd99

media/extractors/mp4/ItemTable.cpp

diff --git a/media/extractors/mp4/ItemTable.cpp b/media/extractors/mp4/ItemTable.cpp
index a1f6e9a..b6787af 100644
--- a/media/extractors/mp4/ItemTable.cpp
+++ b/media/extractors/mp4/ItemTable.cpp
@@ -1397,7 +1397,8 @@
         ALOGV("adding %s: itemId %d", image.isGrid() ? "grid" : "image", info.itemId);
 
         if (image.isGrid()) {
-            if (size > 12) {
+            // ImageGrid struct is at least 8-byte, at most 12-byte (if flags&1)
+            if (size < 8 || size > 12) {
                 return ERROR_MALFORMED;
             }
             uint8_t buf[12];