MatroskaExtractor: detect infinite loop when parsing NALs

Bug: 21335999 Change-Id: I76bd34610e52048ffcf16e41aa6175afc8a14ee4

MatroskaExtractor: detect infinite loop when parsing NALs
Bug: 21335999 Change-Id: I76bd34610e52048ffcf16e41aa6175afc8a14ee4
2dcf6138 · Robert Shih · bc24bb8a · 2dcf6138
Commit 2dcf6138 authored 9 years ago by Robert Shih
Hide whitespace changes
Inline Side-by-side

Showing with 7 additions and 1 deletion

media/libstagefright/matroska/MatroskaExtractor.cpp media/libstagefright/matroska/MatroskaExtractor.cpp +7 -1

No files found.
--- a/media/libstagefright/matroska/MatroskaExtractor.cpp
+++ b/media/libstagefright/matroska/MatroskaExtractor.cpp
@@ -21,6 +21,7 @@
 #include "MatroskaExtractor.h"

 #include <media/stagefright/foundation/ADebug.h>
+#include <media/stagefright/foundation/AUtils.h>
 #include <media/stagefright/foundation/hexdump.h>
 #include <media/stagefright/DataSource.h>
 #include <media/stagefright/MediaBuffer.h>
@@ -620,7 +621,12 @@ status_t MatroskaSource::read(
                    TRESPASS();
            }

-            if (srcOffset + mNALSizeLen + NALsize > srcSize) {
+            if (srcOffset + mNALSizeLen + NALsize <= srcOffset + mNALSizeLen) {
+                frame->release();
+                frame = NULL;
+
+                return ERROR_MALFORMED;
+            } else if (srcOffset + mNALSizeLen + NALsize > srcSize) {
                break;
            }