Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2e101d11 authored by TreeHugger Robot's avatar TreeHugger Robot Committed by Automerger Merge Worker
Browse files

Merge "Really fix excessive 'trun' box parsing" into qt-qpr1-dev am: 01102840 am: 8664abd1 

Change-Id: Iff1014a2a48de79273c7ad856ed38bf9be7fe8b7
parents f64a89e9 8664abd1

media/extractors/mp4/MPEG4Extractor.cpp

+9 −8
Original line number Diff line number Diff line
@@ -5458,16 +5458,12 @@ status_t MPEG4Source::parseTrackFragmentRun(off64_t offset, off64_t size) { 


        // apply some sanity (vs strict legality) checks

        //

        // clamp the count of entries in the trun box, to avoid spending forever parsing

        // this box. Clamping (vs error) lets us play *something*.

        // 1 million is about 400 msecs on a Pixel3, should be no more than a couple seconds

        // on the slowest devices.

        static constexpr uint32_t kMaxTrunSampleCount = 1000000;

        static constexpr uint32_t kMaxTrunSampleCount = 10000;

        if (sampleCount > kMaxTrunSampleCount) {

            ALOGW("b/123389881 clamp sampleCount(%u) @ kMaxTrunSampleCount(%u)",

            ALOGW("b/123389881 sampleCount(%u) > kMaxTrunSampleCount(%u)",

                  sampleCount, kMaxTrunSampleCount);

            android_errorWriteLog(0x534e4554, "124389881 count");



            return -EINVAL;

        }

    }
@@ -5511,7 +5507,12 @@ status_t MPEG4Source::parseTrackFragmentRun(off64_t offset, off64_t size) { 
        tmp.duration = sampleDuration;

        tmp.compositionOffset = sampleCtsOffset;

        memset(tmp.iv, 0, sizeof(tmp.iv));

        mCurrentSamples.add(tmp);

        if (mCurrentSamples.add(tmp) < 0) {

            ALOGW("b/123389881 failed saving sample(n=%zu)", mCurrentSamples.size());

            android_errorWriteLog(0x534e4554, "124389881 allocation");

            mCurrentSamples.clear();

            return NO_MEMORY;

        }



        dataOffset += sampleSize;

    }