commit de47cd3c5223bb0fdd7376f8ea21ba2f857bafbe
author Abhishek Arya <aarya@google.com> Tue Aug 18 16:40:48 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Tue Aug 18 16:40:48 2015 +0000
tree 8d224b42a7259bc773be43dcee4e5fdd8c97d693
parent 00887af170d5302d1030e107ed3db969b05edcb4
parent 3b77e940822e8a5ef4953b709bdae00fa1bcca43

am 3b77e940: am d146d466: am 6f561b93: Merge "MatroskaExtractor: detect infinite loop when parsing NALs" into klp-dev

* commit '3b77e940822e8a5ef4953b709bdae00fa1bcca43':
  MatroskaExtractor: detect infinite loop when parsing NALs

media/libstagefright/matroska/MatroskaExtractor.cpp

diff --git a/media/libstagefright/matroska/MatroskaExtractor.cpp b/media/libstagefright/matroska/MatroskaExtractor.cpp
index bca1bae..44a1e22 100644
--- a/media/libstagefright/matroska/MatroskaExtractor.cpp
+++ b/media/libstagefright/matroska/MatroskaExtractor.cpp
@@ -21,6 +21,7 @@
 #include "MatroskaExtractor.h"
 
 #include <media/stagefright/foundation/ADebug.h>
+#include <media/stagefright/foundation/AUtils.h>
 #include <media/stagefright/foundation/hexdump.h>
 #include <media/stagefright/DataSource.h>
 #include <media/stagefright/MediaBuffer.h>
@@ -630,7 +631,12 @@
                     TRESPASS();
             }
 
-            if (srcOffset + mNALSizeLen + NALsize > srcSize) {
+            if (srcOffset + mNALSizeLen + NALsize <= srcOffset + mNALSizeLen) {
+                frame->release();
+                frame = NULL;
+
+                return ERROR_MALFORMED;
+            } else if (srcOffset + mNALSizeLen + NALsize > srcSize) {
                 break;
             }