commit b4378b407fcf50bb79418d134ca2523aebf5dfed
author Marco Nelissen <marcone@google.com> Sat Nov 07 01:21:44 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Sat Nov 07 01:21:44 2020 +0000
tree da4150da77265127069c743d1f59dd45e3f6da55
parent f99bcdda484ed8c533bf2b2cce7187e9acf500c6
parent 3624115d600d9b97b78010e93ce7b88e6def79db

Fix memory overflow in ESQueue am: 91fed774ac am: 979ebeacb7 am: 6f24da9b73 am: 8381c1ef9b am: a26215a10a am: d48bd4202c am: 8447914a7f am: 3624115d60

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/12794733

Change-Id: Ibc470721bb228e318c627881114c3e3b2568b706

media/libstagefright/mpeg2ts/ESQueue.cpp

diff --git a/media/libstagefright/mpeg2ts/ESQueue.cpp b/media/libstagefright/mpeg2ts/ESQueue.cpp
index 4bb21fa..ea5d2de 100644
--- a/media/libstagefright/mpeg2ts/ESQueue.cpp
+++ b/media/libstagefright/mpeg2ts/ESQueue.cpp
@@ -1433,7 +1433,13 @@
                 if (mSampleDecryptor != NULL && (nalType == 1 || nalType == 5)) {
                     uint8_t *nalData = mBuffer->data() + pos.nalOffset;
                     size_t newSize = mSampleDecryptor->processNal(nalData, pos.nalSize);
-                    // Note: the data can shrink due to unescaping
+                    // Note: the data can shrink due to unescaping, but it can never grow
+                    if (newSize > pos.nalSize) {
+                        // don't log unless verbose, since this can get called a lot if
+                        // the caller is trying to resynchronize
+                        ALOGV("expected sample size < %u, got %zu", pos.nalSize, newSize);
+                        return NULL;
+                    }
                     memcpy(accessUnit->data() + dstOffset + 4,
                             nalData,
                             newSize);