commit aff26637aae9ad9bb635b78a44d8afad27bb7f03
author Santiago Seifert <aquilescanta@google.com> Tue May 24 15:53:41 2022 +0000
committer Santiago Seifert <aquilescanta@google.com> Wed May 25 09:29:10 2022 +0000
tree fff2d500cdf36ca5dd131d3697d9df698ead5336
parent 68f4bacbf2d39415fa5da19ba5456a08926a336f

Prevent out-of-bounds vector access

Bug: 230172711
Test: See bug for fuzzer testcase.
Test: atest CtsMiscMediaTestCases
Change-Id: I0c7a5940810d567c6bcb9045f35efb477437491a
Merged-In: I0c7a5940810d567c6bcb9045f35efb477437491a
(cherry picked from commit ba7d0869174bf07886a0df5f33f252511215e78b)

media/libstagefright/HevcUtils.cpp

diff --git a/media/libstagefright/HevcUtils.cpp b/media/libstagefright/HevcUtils.cpp
index 5f9c20e..60df162 100644
--- a/media/libstagefright/HevcUtils.cpp
+++ b/media/libstagefright/HevcUtils.cpp
@@ -102,10 +102,11 @@
 static bool findParam(uint32_t key, T *param,
         KeyedVector<uint32_t, uint64_t> &params) {
     CHECK(param);
-    if (params.indexOfKey(key) < 0) {
+    ssize_t index = params.indexOfKey(key);
+    if (index < 0) {
         return false;
     }
-    *param = (T) params[key];
+    *param = (T) params[index];
     return true;
 }