Commit: 7e354f50d3017c8b392c8e10ed940984473e5af1 - frameworks-av (git)

frameworks/av

Commit MetaInfo

• Revision: 7e354f50d3017c8b392c8e10ed940984473e5af1 (tree)
• Time: 2015-09-29 08:27:08
• Author: Wonsik Kim <wonsik@goog...>
• Commiter: The Android Automerger

Log Message

Ogg: avoid size_t overflow in base64 decoding

Bug: 23707088
Change-Id: I8d32841fee3213c721cdcc57788807ea64d19d74

Change Summary

• modified: media/libstagefright/OggExtractor.cpp

Incremental Difference

--- a/media/libstagefright/OggExtractor.cpp
+++ b/media/libstagefright/OggExtractor.cpp
@@ -893,11 +893,14 @@ static uint8_t *DecodeBase64(const char *s, size_t size, size_t *outSize) {
         }
     }
 
-    size_t outLen = 3 * size / 4 - padding;
-
-    *outSize = outLen;
+    // We divide first to avoid overflow. It's OK to do this because we
+    // already made sure that size % 4 == 0.
+    size_t outLen = (size / 4) * 3 - padding;
 
     void *buffer = malloc(outLen);
+    if (buffer == NULL) {
+        return NULL;
+    }
 
     uint8_t *out = (uint8_t *)buffer;
     size_t j = 0;
@@ -916,10 +919,10 @@ static uint8_t *DecodeBase64(const char *s, size_t size, size_t *outSize) {
         } else if (c == '/') {
             value = 63;
         } else if (c != '=') {
-            return NULL;
+            break;
         } else {
             if (i < n - padding) {
-                return NULL;
+                break;
             }
 
             value = 0;
@@ -937,6 +940,13 @@ static uint8_t *DecodeBase64(const char *s, size_t size, size_t *outSize) {
         }
     }
 
+    // Check if we exited the loop early.
+    if (j < outLen) {
+        free(buffer);
+        return NULL;
+    }
+
+    *outSize = outLen;
     return (uint8_t *)buffer;
 }