| commit | e5f0966c76bd0a7e81e4205c8d8b55e6b34c833e | [log] [tgz] |
|---|---|---|
| author | Joshua J. Drake <android-open-source@qoop.org> | Mon May 04 18:29:08 2015 -0500 |
| committer | Wei Jia <wjia@google.com> | Wed Jun 03 15:43:31 2015 -0700 |
| tree | 2a4ea433c05520b8fe5628b778b32a79c88daafb | |
| parent | 0e27e080c255b23b4b0e19cb3bc9519cc162b73f [diff] |
Fix integer overflow when handling MPEG4 tx3g atom When the sum of the 'size' and 'chunk_size' variables is larger than 2^32, an integer overflow occurs. Using the result value to allocate memory leads to an undersized buffer allocation and later a potentially exploitable heap corruption condition. Ensure that integer overflow does not occur. Bug: 20923261 Change-Id: Id050a36b33196864bdd98b5ea24241f95a0b5d1f