Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 42dbdd0e authored by Robert Shih's avatar Robert Shih Committed by Automerger Merge Worker
Browse files

Merge "rtsp: fix integer overflow caused by malformed packets" into qt-qpr1-dev am: 01e349c1 

Change-Id: I811c501fe41494c834d50e50121ee9f436a2179b
parents bbce5f0b 01e349c1

media/libstagefright/rtsp/AMPEG4ElementaryAssembler.cpp

+12 −0
Original line number Diff line number Diff line
@@ -338,6 +338,12 @@ ARTPAssembler::AssemblyStatus AMPEG4ElementaryAssembler::addPacket( 
            ABitReader bits(buffer->data() + offset, buffer->size() - offset);



            unsigned auxSize = bits.getBits(mAuxiliaryDataSizeLength);

            if (buffer->size() < auxSize) {

                ALOGE("b/123940919 auxSize %u", auxSize);

                android_errorWriteLog(0x534e4554, "123940919");

                queue->erase(queue->begin());

                return MALFORMED_PACKET;

            }



            offset += (mAuxiliaryDataSizeLength + auxSize + 7) / 8;

        }
@@ -346,6 +352,12 @@ ARTPAssembler::AssemblyStatus AMPEG4ElementaryAssembler::addPacket( 
             it != headers.end(); ++it) {

            const AUHeader &header = *it;



            if (buffer->size() < header.mSize) {

                ALOGE("b/123940919 AU_size %u", header.mSize);

                android_errorWriteLog(0x534e4554, "123940919");

                queue->erase(queue->begin());

                return MALFORMED_PACKET;

            }

            if (buffer->size() < offset + header.mSize) {

                return MALFORMED_PACKET;

            }