Android-x86
Fork| リビジョン | f059aa712db6b6561c46856f4bf40d35b1519c20 (tree) |
|---|---|
| 日時 | 2018-03-08 20:44:13 |
| 作者 | Robert Shih <robertshih@goog...> |
| コミッター | Moritz Horstmann |
AACExtractor: check bounds during seek
Bug: 70239507
Test: stagefright -a poc.aac
Change-Id: I61225a04c76fe8855bd2591fb14b734099fa3be6
(cherry picked from commit 0790581021d89ae1d7242e5eb1197bfd12725c85)
media/libstagefright/AACExtractor.cpp (diff)| @@ -295,6 +295,10 @@ status_t AACSource::read( | ||
| 295 | 295 | if (options && options->getSeekTo(&seekTimeUs, &mode)) { |
| 296 | 296 | if (mFrameDurationUs > 0) { |
| 297 | 297 | int64_t seekFrame = seekTimeUs / mFrameDurationUs; |
| 298 | + if (seekFrame < 0 || seekFrame >= (int64_t)mOffsetVector.size()) { | |
| 299 | + android_errorWriteLog(0x534e4554, "70239507"); | |
| 300 | + return ERROR_MALFORMED; | |
| 301 | + } | |
| 298 | 302 | mCurrentTimeUs = seekFrame * mFrameDurationUs; |
| 299 | 303 | |
| 300 | 304 | mOffset = mOffsetVector.itemAt(seekFrame); |
