Android-x86
Forkframeworks/av
| Révision | 7306d8b37c00729dc41d663a4b244a00209d537b (tree) |
|---|---|
| l'heure | 2018-05-26 03:39:00 |
| Auteur | Chong Zhang <chz@goog...> |
| Commiter | android-build-team Robot |
Add minimum size check for ImageGrid atom
bug: 73927042
Change-Id: I25dc3aeabe95bd907a418b12b2d06f3691cb1b42
(cherry picked from commit ef75163eb891b5259c0f5c2fc20fca2a5a47b7b7)
media/libstagefright/ItemTable.cpp (diff)| @@ -1335,7 +1335,8 @@ status_t ItemTable::buildImageItemsIfPossible(uint32_t type) { | ||
| 1335 | 1335 | ALOGV("adding %s: itemId %d", image.isGrid() ? "grid" : "image", info.itemId); |
| 1336 | 1336 | |
| 1337 | 1337 | if (image.isGrid()) { |
| 1338 | - if (size > 12) { | |
| 1338 | + // ImageGrid struct is at least 8-byte, at most 12-byte (if flags&1) | |
| 1339 | + if (size < 8 || size > 12) { | |
| 1339 | 1340 | return ERROR_MALFORMED; |
| 1340 | 1341 | } |
| 1341 | 1342 | uint8_t buf[12]; |
