commit 086f929a9ea1721cc89e00ca56b9202d5783e8df
author Rheygine Medel <quic_rmedel@quicinc.com> Wed Oct 26 07:48:05 2022 -0700
committer Rheygine Medel <quic_rmedel@quicinc.com> Thu Oct 27 09:58:54 2022 -0700
tree 5ddc4de95671e60235c1730da7d8538de4c17b54
parent 5107d2b2b82489fdf44b2511815de211cea5dd55

composer: Modify validation of the length in QtiComposerClient

Change-Id: I2e3785e2f3f73d2f275958514672592846b61229
CRs-Fixed: 3319872

composer/QtiComposerClient.cpp

diff --git a/composer/QtiComposerClient.cpp b/composer/QtiComposerClient.cpp
index 2fb19e6..a8e4a9c 100644
--- a/composer/QtiComposerClient.cpp
+++ b/composer/QtiComposerClient.cpp
@@ -1376,7 +1376,7 @@
 
 bool QtiComposerClient::CommandReader::parseSetClientTarget(uint16_t length) {
   // 4 parameters followed by N rectangles
-  if ((length - 4) % 4 != 0) {
+  if (length < 4 || ((length - 4) % 4 != 0)) {
     return false;
   }
 
@@ -1957,7 +1957,7 @@
 bool QtiComposerClient::CommandReader::parseSetLayerPerFrameMetadataBlobs(uint16_t length) {
   // must have at least one metadata blob
   // of at least size 1 in queue (i.e {/*numBlobs=*/1, key, size, blob})
-  if (length < 4) {
+  if (length <= 4) {
     return false;
   }
 
@@ -1971,7 +1971,7 @@
     uint32_t blobSize = read();
     length -= 2;
 
-    if (length * sizeof(uint32_t) < blobSize) {
+    if (length * sizeof(uint32_t) < blobSize && (length % 2 != 0)) {
       return false;
     }