Commit 29ccd8c5 authored by Marco Nelissen's avatar Marco Nelissen Committed by android-build-merger
Browse files

Limit mp4 atom size to something reasonable am: 638c99ba

am: 569f3db6

Change-Id: Icc063dd70e08fea6320e3d3f64ebbd4ba51d8aa8
parents 638aca47 569f3db6
......@@ -23,6 +23,8 @@
#include "include/ESDS.h"
#include <ctype.h>
#define __STDC_FORMAT_MACROS 1
#include <inttypes.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
......@@ -48,6 +50,12 @@
namespace android {
enum {
// maximum size of an atom. Some atoms can be bigger according to the spec,
// but we only allow up to this size.
kMaxAtomSize = 64 * 1024 * 1024,
};
class MPEG4Source : public MediaSource {
public:
// Caller retains ownership of both "dataSource" and "sampleTable".
......@@ -798,6 +806,13 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {
PathAdder autoAdder(&mPath, chunk_type);
off64_t chunk_data_size = *offset + chunk_size - data_offset;
if (chunk_type != FOURCC('m', 'd', 'a', 't') && chunk_data_size > kMaxAtomSize) {
char errMsg[100];
sprintf(errMsg, "%s atom has size %" PRId64, chunk, chunk_data_size);
ALOGE("%s (b/28615448)", errMsg);
android_errorWriteWithInfoLog(0x534e4554, "28615448", -1, errMsg, strlen(errMsg));
return ERROR_MALFORMED;
}
if (chunk_type != FOURCC('c', 'p', 'r', 't')
&& chunk_type != FOURCC('c', 'o', 'v', 'r')
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment