Bug 1204580 - p2: Check box ranges. r=rillian, a=al
authorGerald Squelart <gsquelart@mozilla.com>
Fri, 02 Oct 2015 09:20:39 +0200
changeset 289605 4cebb6ab9288
parent 289604 fbd30c48f6ec
child 289606 e1261e250e85
push id5214
push usercbook@mozilla.com
push date2015-10-22 07:41 +0000
treeherdermozilla-beta@4cebb6ab9288 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersrillian, al
bugs1204580
milestone42.0
Bug 1204580 - p2: Check box ranges. r=rillian, a=al
media/libstagefright/binding/Box.cpp
--- a/media/libstagefright/binding/Box.cpp
+++ b/media/libstagefright/binding/Box.cpp
@@ -35,16 +35,21 @@ BoxOffset(AtomType aType)
 
   return 0;
 }
 
 Box::Box(BoxContext* aContext, uint64_t aOffset, const Box* aParent)
   : mContext(aContext), mParent(aParent)
 {
   uint8_t header[8];
+
+  if (aOffset > INT64_MAX - sizeof(header)) {
+    return;
+  }
+
   MediaByteRange headerRange(aOffset, aOffset + sizeof(header));
   if (mParent && !mParent->mRange.Contains(headerRange)) {
     return;
   }
 
   const MediaByteRange* byteRange;
   for (int i = 0; ; i++) {
     if (i == mContext->mByteRanges.Length()) {
@@ -62,39 +67,51 @@ Box::Box(BoxContext* aContext, uint64_t 
                                        &bytes) ||
       bytes != sizeof(header)) {
     return;
   }
 
   uint64_t size = BigEndian::readUint32(header);
   if (size == 1) {
     uint8_t bigLength[8];
+    if (aOffset > INT64_MAX - sizeof(header) - sizeof(bigLength)) {
+      return;
+    }
     MediaByteRange bigLengthRange(headerRange.mEnd,
                                   headerRange.mEnd + sizeof(bigLength));
     if ((mParent && !mParent->mRange.Contains(bigLengthRange)) ||
         !byteRange->Contains(bigLengthRange) ||
-        !mContext->mSource->CachedReadAt(aOffset + 8, bigLength,
+        !mContext->mSource->CachedReadAt(aOffset + sizeof(header), bigLength,
                                          sizeof(bigLength), &bytes) ||
         bytes != sizeof(bigLength)) {
       return;
     }
     size = BigEndian::readUint64(bigLength);
     mBodyOffset = bigLengthRange.mEnd;
   } else if (size == 0) {
     // box extends to end of file.
     size = mContext->mByteRanges.LastElement().mEnd - aOffset;
     mBodyOffset = headerRange.mEnd;
   } else {
     mBodyOffset = headerRange.mEnd;
   }
 
+  if (size > INT64_MAX) {
+    return;
+  }
+  int64_t end = static_cast<int64_t>(aOffset) + static_cast<int64_t>(size);
+  if (end < static_cast<int64_t>(aOffset)) {
+    // Overflowed.
+    return;
+  }
+
   mType = BigEndian::readUint32(&header[4]);
   mChildOffset = mBodyOffset + BoxOffset(mType);
 
-  MediaByteRange boxRange(aOffset, aOffset + size);
+  MediaByteRange boxRange(aOffset, end);
   if (mChildOffset > boxRange.mEnd ||
       (mParent && !mParent->mRange.Contains(boxRange)) ||
       !byteRange->Contains(boxRange)) {
     return;
   }
 
   mRange = boxRange;
 }