Bug 1204580 - Check box ranges for overflow - r=rillian, a=al
authorGerald Squelart <gsquelart@mozilla.com>
Thu, 22 Oct 2015 10:00:12 +0200
changeset 260800 7909587936ebe419477aa7a564616d51003884e8
parent 260799 e86f9e9310838095413e11ebeee54ca0dedc46e4
child 260801 6977971bfc3c856bb42893f9dfbe4dd4f9a53708
push id191
push usercbook@mozilla.com
push dateThu, 22 Oct 2015 08:00:36 +0000
treeherdermozilla-esr38@7909587936eb [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersrillian, al
bugs1204580
milestone38.3.0
Bug 1204580 - Check box ranges for overflow - r=rillian, a=al
media/libstagefright/binding/Box.cpp
--- a/media/libstagefright/binding/Box.cpp
+++ b/media/libstagefright/binding/Box.cpp
@@ -35,16 +35,21 @@ BoxOffset(AtomType aType)
 
   return 0;
 }
 
 Box::Box(BoxContext* aContext, uint64_t aOffset, const Box* aParent)
   : mContext(aContext), mParent(aParent)
 {
   uint8_t header[8];
+
+  if (aOffset > INT64_MAX - sizeof(header)) {
+    return;
+  }
+
   MediaByteRange headerRange(aOffset, aOffset + sizeof(header));
   if (mParent && !mParent->mRange.Contains(headerRange)) {
     return;
   }
 
   const MediaByteRange* byteRange;
   for (int i = 0; ; i++) {
     if (i == mContext->mByteRanges.Length()) {
@@ -62,35 +67,47 @@ Box::Box(BoxContext* aContext, uint64_t 
                                        &bytes) ||
       bytes != sizeof(header)) {
     return;
   }
 
   uint64_t size = BigEndian::readUint32(header);
   if (size == 1) {
     uint8_t bigLength[8];
+    if (aOffset > INT64_MAX - sizeof(header) - sizeof(bigLength)) {
+      return;
+    }
     MediaByteRange bigLengthRange(headerRange.mEnd,
                                   headerRange.mEnd + sizeof(bigLength));
     if ((mParent && !mParent->mRange.Contains(bigLengthRange)) ||
         !byteRange->Contains(bigLengthRange) ||
-        !mContext->mSource->CachedReadAt(aOffset, bigLength,
+        !mContext->mSource->CachedReadAt(aOffset + sizeof(header), bigLength,
                                          sizeof(bigLength), &bytes) ||
         bytes != sizeof(bigLength)) {
       return;
     }
     size = BigEndian::readUint64(bigLength);
     mBodyOffset = bigLengthRange.mEnd;
   } else {
     mBodyOffset = headerRange.mEnd;
   }
 
+  if (size > INT64_MAX) {
+    return;
+  }
+  int64_t end = static_cast<int64_t>(aOffset) + static_cast<int64_t>(size);
+  if (end < static_cast<int64_t>(aOffset)) {
+    // Overflowed.
+    return;
+  }
+
   mType = BigEndian::readUint32(&header[4]);
   mChildOffset = mBodyOffset + BoxOffset(mType);
 
-  MediaByteRange boxRange(aOffset, aOffset + size);
+  MediaByteRange boxRange(aOffset, end);
   if (mChildOffset > boxRange.mEnd ||
       (mParent && !mParent->mRange.Contains(boxRange)) ||
       !byteRange->Contains(boxRange)) {
     return;
   }
 
   mRange = boxRange;
 }