Code: status_t SampleTable::setSyncSampleParams(off64_t data_offset, size_t data_size) {
 if (mSyncSampleOffset >= 0 || data_size < 8) {
 return ERROR_MALFORMED;
 }

    mSyncSampleOffset = data_offset;

 uint8_t header[8];
 if (mDataSource->readAt(
                data_offset, header, sizeof(header)) < (ssize_t)sizeof(header)) {
 return ERROR_IO;
 }

 if (U32_AT(header) != 0) {
 return ERROR_MALFORMED;
 }

    mNumSyncSamples = U32_AT(&header[4]);

 if (mNumSyncSamples < 2) {

         ALOGV("Table of sync samples is empty or has only a single entry!");
     }
 
     mSyncSamples = new uint32_t[mNumSyncSamples];
     size_t size = mNumSyncSamples * sizeof(uint32_t);
     if (mDataSource->readAt(mSyncSampleOffset + 8, mSyncSamples, size)
 != (ssize_t)size) {
 return ERROR_IO;
 }

 for (size_t i = 0; i < mNumSyncSamples; ++i) {
        mSyncSamples[i] = ntohl(mSyncSamples[i]) - 1;
 }

 return OK;
}

Commit Message: SampleTable: check integer overflow during table alloc

Bug: 15328708
Bug: 15342615
Bug: 15342751
Change-Id: I6bb110a1eba46506799c73be8ff9a4f71c7e7053

CWE ID: CWE-189
status_t SampleTable::setSyncSampleParams(off64_t data_offset, size_t data_size) {
 if (mSyncSampleOffset >= 0 || data_size < 8) {
 return ERROR_MALFORMED;
 }

    mSyncSampleOffset = data_offset;

 uint8_t header[8];
 if (mDataSource->readAt(
                data_offset, header, sizeof(header)) < (ssize_t)sizeof(header)) {
 return ERROR_IO;
 }

 if (U32_AT(header) != 0) {
 return ERROR_MALFORMED;
 }

    mNumSyncSamples = U32_AT(&header[4]);

 if (mNumSyncSamples < 2) {

         ALOGV("Table of sync samples is empty or has only a single entry!");
     }
 
    uint64_t allocSize = mNumSyncSamples * sizeof(uint32_t);
    if (allocSize > SIZE_MAX) {
        return ERROR_OUT_OF_RANGE;
    }

     mSyncSamples = new uint32_t[mNumSyncSamples];
     size_t size = mNumSyncSamples * sizeof(uint32_t);
     if (mDataSource->readAt(mSyncSampleOffset + 8, mSyncSamples, size)
 != (ssize_t)size) {
 return ERROR_IO;
 }

 for (size_t i = 0; i < mNumSyncSamples; ++i) {
        mSyncSamples[i] = ntohl(mSyncSamples[i]) - 1;
 }

 return OK;
}
