1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
|
From ef6298177a8390c01f5084ba89a808015a0b9473 Mon Sep 17 00:00:00 2001
From: Gerald Squelart <gsquelart@mozilla.com>
Date: Thu, 22 Oct 2015 10:00:12 +0200
Subject: [PATCH] Bug 1204580 - Check box ranges for overflow - r=rillian, a=al
---
media/libstagefright/binding/Box.cpp | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)
diff --git a/media/libstagefright/binding/Box.cpp b/media/libstagefright/binding/Box.cpp
index 71c79ed..2558be0 100644
--- a/media/libstagefright/binding/Box.cpp
+++ b/media/libstagefright/binding/Box.cpp
@@ -40,6 +40,11 @@ Box::Box(BoxContext* aContext, uint64_t aOffset, const Box* aParent)
: mContext(aContext), mParent(aParent)
{
uint8_t header[8];
+
+ if (aOffset > INT64_MAX - sizeof(header)) {
+ return;
+ }
+
MediaByteRange headerRange(aOffset, aOffset + sizeof(header));
if (mParent && !mParent->mRange.Contains(headerRange)) {
return;
@@ -67,11 +72,14 @@ Box::Box(BoxContext* aContext, uint64_t aOffset, const Box* aParent)
uint64_t size = BigEndian::readUint32(header);
if (size == 1) {
uint8_t bigLength[8];
+ if (aOffset > INT64_MAX - sizeof(header) - sizeof(bigLength)) {
+ return;
+ }
MediaByteRange bigLengthRange(headerRange.mEnd,
headerRange.mEnd + sizeof(bigLength));
if ((mParent && !mParent->mRange.Contains(bigLengthRange)) ||
!byteRange->Contains(bigLengthRange) ||
- !mContext->mSource->CachedReadAt(aOffset, bigLength,
+ !mContext->mSource->CachedReadAt(aOffset + sizeof(header), bigLength,
sizeof(bigLength), &bytes) ||
bytes != sizeof(bigLength)) {
return;
@@ -82,10 +90,19 @@ Box::Box(BoxContext* aContext, uint64_t aOffset, const Box* aParent)
mBodyOffset = headerRange.mEnd;
}
+ if (size > INT64_MAX) {
+ return;
+ }
+ int64_t end = static_cast<int64_t>(aOffset) + static_cast<int64_t>(size);
+ if (end < static_cast<int64_t>(aOffset)) {
+ // Overflowed.
+ return;
+ }
+
mType = BigEndian::readUint32(&header[4]);
mChildOffset = mBodyOffset + BoxOffset(mType);
- MediaByteRange boxRange(aOffset, aOffset + size);
+ MediaByteRange boxRange(aOffset, end);
if (mChildOffset > boxRange.mEnd ||
(mParent && !mParent->mRange.Contains(boxRange)) ||
!byteRange->Contains(boxRange)) {
--
2.5.0
|