Bug 1123507 - Prevent out of bound memory access. r=edwin, a=sledru
authorJean-Yves Avenard <jyavenard@mozilla.com>
Tue, 20 Jan 2015 13:42:30 +1100
changeset 242955 8691f7169392
parent 242954 cee6bfbbecd7
child 242956 ea7deca21c27
push id4344
push userryanvm@gmail.com
push date2015-01-20 17:02 +0000
treeherdermozilla-beta@ea7deca21c27 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersedwin, sledru
bugs1123507
milestone36.0
Bug 1123507 - Prevent out of bound memory access. r=edwin, a=sledru
media/libstagefright/binding/Box.cpp
--- a/media/libstagefright/binding/Box.cpp
+++ b/media/libstagefright/binding/Box.cpp
@@ -43,18 +43,18 @@ Box::Box(BoxContext* aContext, uint64_t 
   uint64_t size = BigEndian::readUint32(header);
   if (size == 1) {
     uint8_t bigLength[8];
     MediaByteRange bigLengthRange(headerRange.mEnd,
                                   headerRange.mEnd + sizeof(bigLength));
     if ((mParent && !mParent->mRange.Contains(bigLengthRange)) ||
         !byteRange->Contains(bigLengthRange) ||
         !mContext->mSource->CachedReadAt(aOffset, bigLength,
-                                         sizeof(bigLengthRange), &bytes) ||
-        bytes != sizeof(bigLengthRange)) {
+                                         sizeof(bigLength), &bytes) ||
+        bytes != sizeof(bigLength)) {
       return;
     }
     size = BigEndian::readUint64(bigLength);
     mChildOffset = bigLengthRange.mEnd;
   } else {
     mChildOffset = headerRange.mEnd;
   }