Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4878995f authored by Robert Shih's avatar Robert Shih
Browse files

AMPEG4ElementaryAssembler: reject malformed desc 

Bug: 124777537
Test: (1) python rtsp_server2.py $server_addr
Test: (2) adb shell am start -a android.intent.action.VIEW
  -n com.google.android.apps.photos/.pager.HostPhotoPagerActivity
  -t video/'*' -d rtsp://$server_addr/a.mp4
Change-Id: Iacc6882819e0d99ffdab409324301e8f8d8125f7
parent b15473e5

media/libstagefright/rtsp/AMPEG4ElementaryAssembler.cpp

+8 −0
Original line number Diff line number Diff line
@@ -203,6 +203,14 @@ struct AUHeader { 
    unsigned mSerial;

};



bool AMPEG4ElementaryAssembler::initCheck() {

    if(mSizeLength == 0 || mIndexLength == 0 || mIndexDeltaLength == 0) {

        android_errorWriteLog(0x534e4554, "124777537");

        return false;

    }

    return true;

}



ARTPAssembler::AssemblyStatus AMPEG4ElementaryAssembler::addPacket(

        const sp<ARTPSource> &source) {

    List<sp<ABuffer> > *queue = source->queue();

media/libstagefright/rtsp/AMPEG4ElementaryAssembler.h

+1 −0
Original line number Diff line number Diff line
@@ -36,6 +36,7 @@ struct AMPEG4ElementaryAssembler : public ARTPAssembler { 
    AMPEG4ElementaryAssembler(

            const sp<AMessage> &notify, const AString &desc,

            const AString &params);

    virtual bool initCheck();



protected:

    virtual ~AMPEG4ElementaryAssembler();

media/libstagefright/rtsp/ARTPAssembler.h

+1 −0
Original line number Diff line number Diff line
@@ -39,6 +39,7 @@ struct ARTPAssembler : public RefBase { 


    void onPacketReceived(const sp<ARTPSource> &source);

    virtual void onByeReceived() = 0;

    virtual bool initCheck() { return true; }



protected:

    virtual AssemblyStatus assembleMore(const sp<ARTPSource> &source) = 0;

media/libstagefright/rtsp/ARTPSource.cpp

+8 −2
Original line number Diff line number Diff line
@@ -82,6 +82,10 @@ ARTPSource::ARTPSource( 
    } else {

        TRESPASS();

    }



    if (mAssembler != NULL && !mAssembler->initCheck()) {

        mAssembler.clear();

    }

}



static uint32_t AbsDiff(uint32_t seq1, uint32_t seq2) {
@@ -89,7 +93,7 @@ static uint32_t AbsDiff(uint32_t seq1, uint32_t seq2) { 
}



void ARTPSource::processRTPPacket(const sp<ABuffer> &buffer) {

    if (queuePacket(buffer) && mAssembler != NULL) {

    if (mAssembler != NULL && queuePacket(buffer)) {

        mAssembler->onPacketReceived(this);

    }

}
@@ -171,8 +175,10 @@ bool ARTPSource::queuePacket(const sp<ABuffer> &buffer) { 
}



void ARTPSource::byeReceived() {

    if (mAssembler != NULL) {

        mAssembler->onByeReceived();

    }

}



void ARTPSource::addFIR(const sp<ABuffer> &buffer) {

    if (!mIssueFIRRequests) {