Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d55f55d2 authored by Santiago Seifert's avatar Santiago Seifert
Browse files

Prevent out-of-bounds read 

Bug: 204077881
Test: See bug for PoC instructions.
Change-Id: Ie8d6792ff391d36d0e199a1d7f649e6081c1e8ac
parent 30a4e6c7

media/libstagefright/rtsp/AAVCAssembler.cpp

+4 −0
Original line number Original line Diff line number Diff line
@@ -295,6 +295,10 @@ ARTPAssembler::AssemblyStatus AAVCAssembler::addNALUnit( 
}

}





void AAVCAssembler::checkSpsUpdated(const sp<ABuffer> &buffer) {

void AAVCAssembler::checkSpsUpdated(const sp<ABuffer> &buffer) {

    if (buffer->size() == 0) {

        android_errorWriteLog(0x534e4554, "204077881");

        return;

    }

    const uint8_t *data = buffer->data();

    const uint8_t *data = buffer->data();

    unsigned nalType = data[0] & 0x1f;

    unsigned nalType = data[0] & 0x1f;

    if (nalType == 0x7) {

    if (nalType == 0x7) {