| commit | a81b3779cc6f6046c8a9149bf544e9d726c9b2b2 | [log] [tgz] |
|---|---|---|
| author | Joshua J. Drake <android-open-source@qoop.org> | Mon May 04 18:36:35 2015 -0500 |
| committer | Nick Kralevich <nnk@google.com> | Tue Aug 04 13:58:14 2015 -0700 |
| tree | 271fbb625ce340259990cd50b7cd02e622f1aaf0 | |
| parent | 738a753a3ca7bf8f9f608ca941575626265294e4 [diff] |
Prevent integer overflow when processing covr MPEG4 atoms If the 'chunk_data_size' value is SIZE_MAX, an integer overflow will occur and cause an undersized buffer to be allocated. The following processing then overfills the resulting memory and creates a potentially exploitable condition. Ensure that integer overflow does not occur. (cherrypicked from commit 05ddc499b9d50c90f552ed1333110f28a1406e7c) Bug: 20923261 Change-Id: If09a02738759acdff8d95149bb9cb5f18a0a123e