Fix divide by zero (3fdf9643) · Commits · e / os / android_frameworks_av

media/libmedia/IMediaExtractor.cpp

+3 −0

Original line number	Diff line number	Diff line
		@@ -160,6 +160,9 @@ status_t BnMediaExtractor::onTransact(
		if (data.readUint32(&idx) == NO_ERROR &&
		data.readUint32(&flags) == NO_ERROR) {
		sp<MetaData> meta = getTrackMetaData(idx, flags);
		if (meta == NULL) {
		return UNKNOWN_ERROR;
		}
		meta->writeToParcel(*reply);
		return NO_ERROR;
		}

media/libstagefright/MPEG4Extractor.cpp

+18 −5

Original line number	Diff line number	Diff line
		@@ -479,7 +479,8 @@ sp<MetaData> MPEG4Extractor::getTrackMetaData(
		} else {
		uint32_t sampleIndex;
		uint32_t sampleTime;
		if (track->sampleTable->findThumbnailSample(&sampleIndex) == OK
		if (track->timescale != 0 &&
		track->sampleTable->findThumbnailSample(&sampleIndex) == OK
		&& track->sampleTable->getMetaDataForSample(
		sampleIndex, NULL /* offset /, NULL / size */,
		&sampleTime) == OK) {
		@@ -929,6 +930,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {
		case FOURCC('e', 'd', 't', 's'):
		case FOURCC('w', 'a', 'v', 'e'):
		{
		if (chunk_type == FOURCC('m', 'o', 'o', 'v') && depth != 0) {
		ALOGE("moov: depth %d", depth);
		return ERROR_MALFORMED;
		}
		if (chunk_type == FOURCC('m', 'o', 'o', 'f') && !mMoofFound) {
		// store the offset of the first segment
		mMoofFound = true;
		@@ -957,6 +962,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {

		bool isTrack = false;
		if (chunk_type == FOURCC('t', 'r', 'a', 'k')) {
		if (depth != 1) {
		ALOGE("trak: depth %d", depth);
		return ERROR_MALFORMED;
		}
		isTrack = true;

		Track *track = new Track;
		@@ -980,6 +989,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {
		while (*offset < stop_offset) {
		status_t err = parseChunk(offset, depth + 1);
		if (err != OK) {
		if (isTrack) {
		mLastTrack->skipTrack = true;
		break;
		}
		return err;
		}
		}
		@@ -1325,10 +1338,6 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {

		case FOURCC('s', 't', 's', 'd'):
		{
		if (chunk_data_size < 8) {
		return ERROR_MALFORMED;
		}

		uint8_t buffer[8];
		if (chunk_data_size < (off64_t)sizeof(buffer)) {
		return ERROR_MALFORMED;
		@@ -1997,6 +2006,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {
		{
		*offset += chunk_size;

		if (depth != 1) {
		ALOGE("mvhd: depth %d", depth);
		return ERROR_MALFORMED;
		}
		if (chunk_data_size < 32) {
		return ERROR_MALFORMED;
		}