Backed out changeset 87277085561a (bug 1149605) for bustage on a CLOSED TREE

media/libstagefright/frameworks/av/media/libstagefright/SampleTable.cpp

@@ -205,11 +205,11 @@ status_t SampleTable::setChunkOffsetParams(
     mNumChunkOffsets = U32_AT(&header[4]);
 
     if (mChunkOffsetType == kChunkOffsetType32) {
-        if (data_size < 8 + (uint64_t)mNumChunkOffsets * 4) {
+        if (data_size < 8 + mNumChunkOffsets * 4) {
             return ERROR_MALFORMED;
         }
     } else {
-        if (data_size < 8 + (uint64_t)mNumChunkOffsets * 8) {
+        if (data_size < 8 + mNumChunkOffsets * 8) {
             return ERROR_MALFORMED;
         }
     }
@@ -242,7 +242,7 @@ status_t SampleTable::setSampleToChunkParams(
 
     mNumSampleToChunkOffsets = U32_AT(&header[4]);
 
-    if (data_size < 8 + (uint64_t)mNumSampleToChunkOffsets * 12) {
+    if (data_size < 8 + mNumSampleToChunkOffsets * 12) {
         return ERROR_MALFORMED;
     }
 
@@ -306,7 +306,7 @@ status_t SampleTable::setSampleSizeParams(
             return OK;
         }
 
-        if (data_size < 12 + (uint64_t)mNumSampleSizes * 4) {
+        if (data_size < 12 + mNumSampleSizes * 4) {
             return ERROR_MALFORMED;
         }
     } else {
@@ -323,7 +323,7 @@ status_t SampleTable::setSampleSizeParams(
             return ERROR_MALFORMED;
         }
 
-        if (data_size < 12 + ((uint64_t)mNumSampleSizes * mSampleSizeFieldSize + 4) / 8) {
+        if (data_size < 12 + (mNumSampleSizes * mSampleSizeFieldSize + 4) / 8) {
             return ERROR_MALFORMED;
         }
     }
@@ -349,10 +349,6 @@ status_t SampleTable::setTimeToSampleParams(
     }
 
     mTimeToSampleCount = U32_AT(&header[4]);
-    if (mTimeToSampleCount > (size_t)-1 / 2 / sizeof(uint32_t)) {
-        // Avoid later overflow.
-        return ERROR_MALFORMED;
-    }
     mTimeToSample = new uint32_t[mTimeToSampleCount * 2];
 
     size_t size = sizeof(uint32_t) * mTimeToSampleCount * 2;
@@ -390,7 +386,7 @@ status_t SampleTable::setCompositionTimeToSampleParams(
 
     size_t numEntries = U32_AT(&header[4]);
 
-    if (data_size != ((uint64_t)numEntries + 1) * 8) {
+    if (data_size != (numEntries + 1) * 8) {
         return ERROR_MALFORMED;
     }
 
@@ -435,10 +431,6 @@ status_t SampleTable::setSyncSampleParams(off64_t data_offset, size_t data_size)
     }
 
     mNumSyncSamples = U32_AT(&header[4]);
-    if (mNumSyncSamples > (size_t)-1 / sizeof(uint32_t)) {
-        // Avoid later overflow.
-        return ERROR_MALFORMED;
-    }
 
     if (mNumSyncSamples < 2) {
         ALOGV("Table of sync samples is empty or has only a single entry!");
@@ -615,11 +607,6 @@ SampleTable::parseSampleCencInfo() {
         return ERROR_MALFORMED;
     }
 
-    if (mCencInfoCount > (size_t)-1 / sizeof(SampleCencInfo)) {
-        // Avoid future OOM.
-        return ERROR_MALFORMED;
-    }
-
     mCencInfo = new SampleCencInfo[mCencInfoCount];
     for (uint32_t i = 0; i < mCencInfoCount; i++) {
         mCencInfo[i].mSubsamples = NULL;