diff options
| author | Lajos Molnar <lajos@google.com> | 2017-06-27 13:58:07 -0700 |
|---|---|---|
| committer | MSe <mse1969@posteo.de> | 2017-10-04 23:29:35 +0200 |
| commit | 3e96328616d731a91ec162109e9cc514aa46b23f (patch) | |
| tree | 3439eaa68666d6469202fb7df3312b42f618be60 | |
| parent | 66461a19dae20ad3df643166a39100ef58202bc3 (diff) | |
| download | frameworks_av-3e96328616d731a91ec162109e9cc514aa46b23f.tar.gz frameworks_av-3e96328616d731a91ec162109e9cc514aa46b23f.tar.bz2 frameworks_av-3e96328616d731a91ec162109e9cc514aa46b23f.zip | |
stagefright: avoid buffer overflow in base64 decoder
Bug: 62673128
Change-Id: Id5f04b772aaca3184879bd5bca453ad9e82c7f94
(cherry picked from commit 5e96386ab7a5391185f6b3ed9ea06f3e23ed253b)
CVE-2017-0809
| -rw-r--r-- | media/libstagefright/foundation/base64.cpp | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/media/libstagefright/foundation/base64.cpp b/media/libstagefright/foundation/base64.cpp index 7da7db9411..cc89064067 100644 --- a/media/libstagefright/foundation/base64.cpp +++ b/media/libstagefright/foundation/base64.cpp @@ -78,8 +78,7 @@ sp<ABuffer> decodeBase64(const AString &s) { accum = (accum << 6) | value; if (((i + 1) % 4) == 0) { - out[j++] = (accum >> 16); - + if (j < outLen) { out[j++] = (accum >> 16); } if (j < outLen) { out[j++] = (accum >> 8) & 0xff; } if (j < outLen) { out[j++] = accum & 0xff; } |