commit c9e162bc8a239bfdde8d2546ca1d2d56d3251990
author ybai <ybai@dolby.com> Wed Feb 26 09:01:57 2020 +0800
committer Mikhail Naganov <mnaganov@google.com> Thu Feb 27 19:45:34 2020 +0000
tree 56ce39d03494b20d14cd7bf9d6e91e76238c40d4
parent c62ad13ad8da6b31168f0d9f3e5f2a770ed0bbee

Crash by invalid ac4 field of mp4 file in fuzzy test

Bug: 150391804
Test: crash occurs in fuzzy test.

Change-Id: I8b69c11ea7a4f3573cf19ad85f85bddb44565659
Merged-In: I8b69c11ea7a4f3573cf19ad85f85bddb44565659
(cherry-picked from commit
 9d288727bda47c43d5f5af84b867655ba891cbc4)

media/extractors/mp4/AC4Parser.cpp

diff --git a/media/extractors/mp4/AC4Parser.cpp b/media/extractors/mp4/AC4Parser.cpp
index 13d60c8..25fc4cd 100644
--- a/media/extractors/mp4/AC4Parser.cpp
+++ b/media/extractors/mp4/AC4Parser.cpp
@@ -600,6 +600,10 @@
         if (ac4_dsi_version == 1) {
             uint64_t end = (mDSISize - mBitReader.numBitsLeft()) / 8;
             uint64_t presentation_bytes = end - start;
+            if (pres_bytes < presentation_bytes) {
+                ALOGE("pres_bytes is smaller than presentation_bytes.");
+                return false;
+            }
             uint64_t skip_bytes = pres_bytes - presentation_bytes;
             ALOGV("skipping = %" PRIu64 " bytes", skip_bytes);
             CHECK_BITS_LEFT(skip_bytes * 8);