Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0d138243 authored by Marco Nelissen's avatar Marco Nelissen
Browse files

Fix divide by zero 

and be stricter about the layout of various boxes in mp4 files.

Bug: 31318219
Change-Id: I50034d5b6b1967ca6e88aabeacf49f26ba3c0d32
parent 4a5ef2e4

media/libmedia/IMediaExtractor.cpp

+3 −0
Original line number Diff line number Diff line
@@ -160,6 +160,9 @@ status_t BnMediaExtractor::onTransact( 
            if (data.readUint32(&idx) == NO_ERROR &&

                    data.readUint32(&flags) == NO_ERROR) {

                sp<MetaData> meta = getTrackMetaData(idx, flags);

                if (meta == NULL) {

                    return UNKNOWN_ERROR;

                }

                meta->writeToParcel(*reply);

                return NO_ERROR;

            }

media/libstagefright/MPEG4Extractor.cpp

+18 −5
Original line number Diff line number Diff line
@@ -476,7 +476,8 @@ sp<MetaData> MPEG4Extractor::getTrackMetaData( 
            } else {

                uint32_t sampleIndex;

                uint32_t sampleTime;

                if (track->sampleTable->findThumbnailSample(&sampleIndex) == OK

                if (track->timescale != 0 &&

                        track->sampleTable->findThumbnailSample(&sampleIndex) == OK

                        && track->sampleTable->getMetaDataForSample(

                            sampleIndex, NULL /* offset */, NULL /* size */,

                            &sampleTime) == OK) {
@@ -925,6 +926,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { 
        case FOURCC('s', 'c', 'h', 'i'):

        case FOURCC('e', 'd', 't', 's'):

        {

            if (chunk_type == FOURCC('m', 'o', 'o', 'v') && depth != 0) {

                ALOGE("moov: depth %d", depth);

                return ERROR_MALFORMED;

            }

            if (chunk_type == FOURCC('m', 'o', 'o', 'f') && !mMoofFound) {

                // store the offset of the first segment

                mMoofFound = true;
@@ -953,6 +958,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { 


            bool isTrack = false;

            if (chunk_type == FOURCC('t', 'r', 'a', 'k')) {

                if (depth != 1) {

                    ALOGE("trak: depth %d", depth);

                    return ERROR_MALFORMED;

                }

                isTrack = true;



                Track *track = new Track;
@@ -976,6 +985,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { 
            while (*offset < stop_offset) {

                status_t err = parseChunk(offset, depth + 1);

                if (err != OK) {

                    if (isTrack) {

                        mLastTrack->skipTrack = true;

                        break;

                    }

                    return err;

                }

            }
@@ -1321,10 +1334,6 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { 


        case FOURCC('s', 't', 's', 'd'):

        {

            if (chunk_data_size < 8) {

                return ERROR_MALFORMED;

            }



            uint8_t buffer[8];

            if (chunk_data_size < (off64_t)sizeof(buffer)) {

                return ERROR_MALFORMED;
@@ -1947,6 +1956,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { 
        {

            *offset += chunk_size;



            if (depth != 1) {

                ALOGE("mvhd: depth %d", depth);

                return ERROR_MALFORMED;

            }

            if (chunk_data_size < 32) {

                return ERROR_MALFORMED;

            }