Code: status_t ESDS::parseESDescriptor(size_t offset, size_t size) {
 if (size < 3) {
 return ERROR_MALFORMED;
 }

    offset += 2; // skip ES_ID
    size -= 2;

 unsigned streamDependenceFlag = mData[offset] & 0x80;
 unsigned URL_Flag = mData[offset] & 0x40;
 unsigned OCRstreamFlag = mData[offset] & 0x20;

 ++offset;

     --size;
 
     if (streamDependenceFlag) {
         offset += 2;
         size -= 2;
     }

 if (URL_Flag) {
 if (offset >= size) {

             return ERROR_MALFORMED;
         }
         unsigned URLlength = mData[offset];
         offset += URLlength + 1;
         size -= URLlength + 1;
     }
 
     if (OCRstreamFlag) {
         offset += 2;
         size -= 2;
 
 if ((offset >= size || mData[offset] != kTag_DecoderConfigDescriptor)
 && offset - 2 < size
 && mData[offset - 2] == kTag_DecoderConfigDescriptor) {
            offset -= 2;
            size += 2;

            ALOGW("Found malformed 'esds' atom, ignoring missing OCR_ES_Id.");
 }
 }

 if (offset >= size) {
 return ERROR_MALFORMED;
 }

 uint8_t tag;
 size_t sub_offset, sub_size;
 status_t err = skipDescriptorHeader(
            offset, size, &tag, &sub_offset, &sub_size);

 if (err != OK) {
 return err;
 }

 if (tag != kTag_DecoderConfigDescriptor) {
 return ERROR_MALFORMED;
 }

    err = parseDecoderConfigDescriptor(sub_offset, sub_size);

 return err;
}

Vulnerability Type: Exec Code 
CWE ID: CWE-189
Summary: Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via crafted ESDS atoms, aka internal bug 20139950, a related issue to CVE-2015-4493.
Commit Message: Fix integer underflow in ESDS processing

Several arithmetic operations within parseESDescriptor could underflow, leading
to an out-of-bounds read operation. Ensure that subtractions from 'size' do not
cause it to wrap around.

Bug: 20139950

(cherry picked from commit 07c0f59d6c48874982d2b5c713487612e5af465a)

Change-Id: I377d21051e07ca654ea1f7037120429d3f71924a
