Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3066b141 authored by Toni Heidenreich's avatar Toni Heidenreich Committed by Cherrypicker Worker
Browse files

Fix Out of Bounds Read in AAVCAssembler 

Fixed Out of Bounds Read in dropFramesUntilIframe Function in
AAVCAssembler.
Added missing bound checks in pickStartSeq function of AHEVCAssembler.

Manual cherry-pick of pa/2300853.

Bug: 230630526

Change-Id: Ia9d0b172d0d09e3bf80a3b4bfc5d1125ac00264d
Test: Manual, See bug for repro steps.
(cherry picked from commit fa29e9f0)
Merged-In: Ia9d0b172d0d09e3bf80a3b4bfc5d1125ac00264d
parent 410d0567

media/libstagefright/rtsp/AAVCAssembler.cpp

+6 −2
Original line number Diff line number Diff line
@@ -332,6 +332,11 @@ void AAVCAssembler::checkIFrameProvided(const sp<ABuffer> &buffer) { 
}



bool AAVCAssembler::dropFramesUntilIframe(const sp<ABuffer> &buffer) {

    if (buffer->size() == 0) {

        ALOGE("b/230630526 buffer->size() == 0");

        android_errorWriteLog(0x534e4554, "230630526");

        return false;

    }

    const uint8_t *data = buffer->data();

    unsigned nalType = data[0] & 0x1f;

    if (!mFirstIFrameProvided && nalType < 0x5) {
@@ -624,8 +629,7 @@ int32_t AAVCAssembler::pickStartSeq(const Queue *queue, 
    int32_t firstSeqNo = buffer->int32Data();



    // This only works for FU-A type & non-start sequence

    int32_t nalType = buffer->size() >= 1 ? buffer->data()[0] & 0x1f : -1;

    if (nalType != 28 || (buffer->size() >= 2 && buffer->data()[1] & 0x80)) {

    if (buffer->size() < 2 || (buffer->data()[0] & 0x1f) != 28 || buffer->data()[1] & 0x80) {

        return firstSeqNo;

    }

media/libstagefright/rtsp/AHEVCAssembler.cpp

+3 −3
Original line number Diff line number Diff line
@@ -629,13 +629,13 @@ void AHEVCAssembler::submitAccessUnit() { 


int32_t AHEVCAssembler::pickStartSeq(const Queue *queue,

        uint32_t first, int64_t play, int64_t jit) {

    CHECK(!queue->empty());

    // pick the first sequence number has the start bit.

    sp<ABuffer> buffer = *(queue->begin());

    int32_t firstSeqNo = buffer->int32Data();



    // This only works for FU-A type & non-start sequence

    unsigned nalType = buffer->data()[0] & 0x1f;

    if (nalType != 28 || buffer->data()[2] & 0x80) {

    if (buffer->size() < 3 || (buffer->data()[0] & 0x1f) != 28 || buffer->data()[2] & 0x80) {

        return firstSeqNo;

    }
@@ -645,7 +645,7 @@ int32_t AHEVCAssembler::pickStartSeq(const Queue *queue, 
        if (rtpTime + jit >= play) {

            break;

        }

        if ((data[2] & 0x80)) {

        if (it->size() >= 3 && (data[2] & 0x80)) {

            const int32_t seqNo = it->int32Data();

            ALOGE("finding [HEAD] pkt. \t Seq# (%d ~ )[%d", firstSeqNo, seqNo);

            firstSeqNo = seqNo;